CVE-2024-3094

Katalog CVE

CVSS 10.0 · Critical EPSS 90,5%

Kerentanan Embedded Malicious Code pada tukaani xz. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Advisory KUTIM-CSIRT

• Serangan Rantai Pasok: Ketika Instansi Diserang Lewat Pihak yang Sudah Dipercaya 3 Sep 2026

Rincian

Terbit di NVD

29 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-506: Embedded Malicious Code

EPSS (30 hari)

90,5% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2024-3094 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2272210 issue tracking · advisory vendor
• https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users advisory vendor
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 mailing list · advisory vendor
• https://tukaani.org/xz-backdoor/ issue tracking · advisory vendor
• https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-co... advisory pihak ketiga · pemerintah AS
• https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-conn... advisory pihak ketiga
• https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ advisory pihak ketiga
• https://boehs.org/node/everything-i-know-about-the-xz-backdoor advisory pihak ketiga
• https://bugs.gentoo.org/928134 issue tracking · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1222124 issue tracking · advisory pihak ketiga
• https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 advisory pihak ketiga
• https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 advisory pihak ketiga
• https://github.com/advisories/GHSA-rxwq-x6h5-x525 advisory pihak ketiga
• https://github.com/karcherm/xz-malware advisory pihak ketiga
• https://gynvael.coldwind.pl/?lang=en&id=782 deskripsi teknis · advisory pihak ketiga
• https://lists.debian.org/debian-security-announce/2024/msg00057.html mailing list · advisory pihak ketiga
• https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html advisory pihak ketiga
• https://lwn.net/Articles/967180/ issue tracking · advisory pihak ketiga
• https://news.ycombinator.com/item?id=39865810 issue tracking · advisory pihak ketiga
• https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2024-3094 advisory pihak ketiga
• https://security.alpinelinux.org/vuln/CVE-2024-3094 advisory pihak ketiga
• https://security.archlinux.org/CVE-2024-3094 advisory pihak ketiga
• https://twitter.com/LetsDefendIO/status/1774804387417751958 advisory pihak ketiga