LiveActive security incident?Get immediate response
CVE Record

CVE-2024-3094: Xz: malicious code in distributed source

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2024-3094 is an intentional software supply-chain backdoor placed in upstream xz 5.6.0 and 5.6.1 source tarballs. During compilation, concealed material modifies liblzma, potentially allowing linked software’s data to be intercepted or altered. Its impact can be severe, but exposure depends on package provenance and build conditions—not merely whether xz is installed.

Executive priority

Treat this as an immediate supply-chain investigation. Rapidly establish whether affected artifacts entered production or build pipelines, isolate confirmed matches, and rebuild from trusted sources. Avoid assuming fleet-wide compromise: exposure is narrower than the headline severity and depends on provenance, packaging, and build conditions.

Technical view

The compromised build process extracts a prebuilt object from a disguised test file through multiple obfuscation stages. That object modifies selected liblzma functions in the resulting library. Software linked to the altered library may consequently have data interactions intercepted or changed. The supplied record assigns CVSS 3.1 score 10.0 and CWE-506 for embedded malicious code.

Likely exposure

Prioritize systems, build caches, artifacts, and container images containing xz or liblzma built from upstream 5.6.0 or 5.6.1 tarballs. Package version alone is insufficient; determine source and build provenance. The bundle lists Red Hat Enterprise Linux 6–10 and JBoss EAP 8 as unaffected.

Exploitation context

This was deliberate supply-chain tampering rather than an accidental coding defect. The supplied record is not in CISA KEV, and the provided evidence does not establish active exploitation in the wild. Distribution of malicious source is confirmed, but actual compromise requires an affected artifact and applicable runtime conditions.

Researcher notes

Focus analysis on compiled-artifact provenance and build behavior. The malicious object was concealed in test material and introduced during compilation, so source-tree review or installed-version checks alone may miss relevant evidence. The bundle confirms modified liblzma behavior but does not fully define every activation condition, victim environment, or observed post-compromise action.

Mitigation direction

  • Identify and isolate artifacts derived from upstream xz 5.6.0 or 5.6.1 tarballs.
  • Follow the applicable operating-system or package vendor advisory for an approved replacement or rollback.
  • Rebuild affected software and container images from verified, trusted source packages.
  • Invalidate compromised build caches and prevent affected artifacts from being redeployed.
  • Review vendor guidance before returning potentially affected systems to service.

Validation and detection

  • Inventory xz and liblzma versions across hosts, containers, build systems, and cached artifacts.
  • Establish each package’s source, distributor, tarball provenance, and build history.
  • Compare findings with the applicable distribution advisory; do not infer exposure from version alone.
  • Verify rebuilt artifacts no longer derive from the identified upstream tarballs.
  • Review relevant security telemetry for unexplained behavior during the possible exposure period.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-506: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-3094 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
42Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96redhat

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2024-3094Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. Source timelineredhat

    Made public.

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorxzxz, 5.6.0, 5.6.1unaffected
Red HatRed Hat Enterprise Linux 10xzunaffected
Red HatRed Hat Enterprise Linux 6xzunaffected
Red HatRed Hat Enterprise Linux 7xzunaffected
Red HatRed Hat Enterprise Linux 8xzunaffected
Red HatRed Hat Enterprise Linux 9xzunaffected
Red HatRed Hat JBoss Enterprise Application Platform 8xzunaffected
Weakness

CWE details

CWE-506

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-506 · source CWE mapping

Embedded Malicious Code

Embedded Malicious Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs