CVE-2024-3094 XZ Utils backdoor research - attack surface visualiser, system vulnerability checker, and general Linux CVE assessment tool
By Nikolaos Natsopoulos, IAM Consultant
Interactive browser-based tool accompanying the research report:
"CVE-2024-3094: Supply Chain Compromise via Social Engineering and Build System Manipulation in XZ Utils"
In March 2024, a backdoor was discovered in XZ Utils (CVE-2024-3094) moments before it could reach stable Linux distributions worldwide. It received the maximum CVSS score of 10.0. The attack involved a fictitious contributor spending nearly three years infiltrating the project before inserting code that would have enabled unauthenticated remote code execution on millions of Linux servers.
This tool provides two things:
An upgraded version of the System Checker with extended CVE coverage and additional vulnerability assessment features is available in the /CVE-Vulnerability-Assessment-Tool folder.
Download xz-toolkit_Visual_Checker.html and open it in any browser. No installation, no server, no internet connection required. Everything is self-contained in a single file.
Attack Visualiser tab - click any phase in the left panel to step through the attack timeline. The dependency chain updates to show exactly where the attack path exists at each stage. Phases are colour coded: blue for setup, yellow for warning signs, red for injection, green for discovery and response.
System Checker tab - run these three commands on the system you want to evaluate:
xz --version
ldd /usr/sbin/sshd
systemctl is-active ssh
Paste the output into the three fields and click Analyse System. The tool evaluates the five conditions required for exploitation and returns a verdict with a per-condition breakdown. Click "Visualise this system's dependency chain" to see your actual library profile rendered in the chain diagram.
Fully vulnerable - Debian Sid with XZ 5.6.1
XZ version:
xz (XZ Utils) 5.6.1
liblzma 5.6.1
sshd dependencies:
libsystemd.so.0 => /lib/x86_64-linux-gnu/libsystemd.so.0
liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6
SSH status:
active (running) since Fri 2024-03-29 11:42:01 UTC
Expected: VULNERABLE - all five conditions satisfied.
Not vulnerable - Ubuntu LTS with XZ 5.4.6
XZ version:
xz (XZ Utils) 5.4.6
liblzma 5.4.6
sshd dependencies:
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3
libpam.so.0 => /lib/x86_64-linux-gnu/libpam.so.0
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6
SSH status:
active (running) since Thu 2024-03-28 09:15:33 UTC
Expected: NOT VULNERABLE - XZ version is safe, liblzma and libsystemd absent from sshd.
Not vulnerable - Arch Linux with XZ 5.6.0 (architecturally protected)
XZ version:
xz (XZ Utils) 5.6.0
liblzma 5.6.0
sshd dependencies:
libcrypto.so.3 => /usr/lib/libcrypto.so.3
libpam.so.0 => /usr/lib/libpam.so.0
libc.so.6 => /usr/lib/libc.so.6
SSH status:
active (running) since Sat 2024-03-30 08:22:11 UTC
Expected: NOT VULNERABLE - XZ 5.6.0 is the backdoored version, but the system is not exploitable because Arch Linux does not apply the sd_notify patch to OpenSSH, meaning liblzma is never linked into sshd. The vulnerability was architecture-specific, not just version-specific.
All five must be satisfied simultaneously for a system to be vulnerable:
A key finding of the accompanying research report is that this attack represents a novel threat model for Identity and Access Management practitioners. The backdoor did not steal credentials or bypass access controls in the conventional sense - it replaced the authentication mechanism itself, operating below PAM, RBAC, MFA, and Zero Trust. No conventional IAM control would have prevented exploitation.
Controls that would have helped: multi-party release approval, tarball vs git repository diff checking, runtime binary integrity monitoring (IMA/dm-verity), and anomaly detection on SSH authentication latency.
Copyright (c) 2026 Nikolaos Natsopoulos. MIT License.