xz Utils backdoor (CVE-2024-3094)

xz Utils is a compression tool and library (liblzma) found on almost every Linux system. From 2021, someone using the name “Jia Tan” made helpful contributions while sock-puppet accounts pressured the original maintainer to hand over more control. Jia Tan became a maintainer, and in February 2024 released versions 5.6.0 and 5.6.1 with a hidden backdoor.

The trick was in the build, not the code people review. Malicious test files sat in the repository, and a modified build script that existed only in the release tarballs injected them into liblzma. Several distributions patch OpenSSH to work with systemd, which loads liblzma, so the backdoor ended up inside the SSH server. Anyone holding the attacker's private key could then take control of x86-64 Linux systems remotely.

It was caught before reaching stable releases. Andres Freund, a Microsoft engineer, noticed SSH logins on a Debian development system using unusual CPU and causing Valgrind errors, dug in, and disclosed it on 29 March 2024. Distributions rolled back, and there is no known exploitation. The lesson: what you build is not always what you reviewed, and overworked open-source maintainers are part of your attack surface.