XZ Backdoor: CVE-2024-3094 in XZ Utils

Malicious code in the upstream tarballs of XZ Utils 5.6.0 and 5.6.1 that changes liblzma.

Published in the NVD on 29/03/2024

CVE-2024-3094

CVSS 3.1: 10.0 (critical)

Not in the CISA catalogue of actively exploited vulnerabilities

Exploitation probability (EPSS, 01/11/2026): 90.900 %, percentile 99.806

What is XZ Backdoor?

The XZ backdoor is malicious code in the upstream tarballs of XZ Utils, starting with version 5.6.0. Through a series of obfuscated steps, the liblzma build extracts a prebuilt object file from a disguised test file and uses it to modify functions in liblzma. Every program linked against this library can then have its data intercepted and modified.

The NVD rates it at CVSS 10.0 and lists the versions 5.6.0 and 5.6.1. According to the Debian Security Tracker, Debian 12 never contained the code. CISA does not list it in its catalogue of actively exploited vulnerabilities.

Affected and fixed versions

XZ Utils

Affected: 5.6.0, 5.6.1

No fixed version given in the NVD data

Status in Debian and Ubuntu

Debian 12: xz-utils

Not affected

Debian 13: xz-utils

Fixed

Fixed from package version 5.6.1+really5.4.5-1

Ubuntu 20.04 LTS: xz-utils

Fixed

Fixed from package version 5.2.4-1ubuntu1.1

Ubuntu 22.04 LTS: xz-utils

Fixed

Fixed from package version 5.2.5-2ubuntu1

Ubuntu 24.04 LTS: xz-utils

Fixed

Fixed from package version 5.4.5-0.3

What to do

Check the installed version with xz --version. If it reports 5.6.0 or 5.6.1, install the update of your distribution straight away.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch xz-utils (Debian 13)

Watch xz-utils (Ubuntu 24.04 LTS)

Already have an account? Log in and add xz-utils (Debian 13)