XZ Utils backdoor

On 29 March 2024, software developer Andres Freund reported that he had found a maliciously introduced backdoor in the Linux utility xz within the liblzma library in versions 5.6.0 and 5.6.1 released in February 2024.^[1]

xz is a software that is present in most Linux distributions. It is used for compressing and decompressing data. Liblzma is a library, a piece of software that other programs can use. It allows to compress and decompress using the Lempel–Ziv–Markov chain algorithm. The backdoor targeted systems running Debian and RPM-based systems running on the x86-64 architecture. At the time of discovery the backdoored version had not yet been widely deployed.^[2]

Using the backdoor, an attacker who has a specific an Ed448 private key can get remote code execution capabilities on the affected Linux systems. The issue has been assigned a CVSS score of 10.0, the highest possible score.^[3][4][5]

The Microsoft employee and PostgreSQL developer Andres Freund reported the backdoor after investigating a performance regression in Debian Sid.^[6] Freund noticed that SSH connections were generating an unexpectedly high amount of CPU usage as well as causing errors in Valgrind,^[7] a memory debugging tool.^[8] Freund reported his finding to Openwall Project's open source security mailing list.^[9] This brought it to the attention of various software vendors.^[8] There is evidence that the attacker made efforts to hide the code.^[10][11] The backdoor is made of multiple stages that act together.^[12]

When the compromised version is incorporated into the operating system, it changes the behavior of OpenSSH's SSH server daemon. It abuses the systemd library, allowing the attacker to gain the same level of access as any authorized administrator.^[12][8] According to the analysis by Red Hat, the backdoor can "enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely".^[13]

An investigation found that the efforts to insert the backdoor took about three years. A user known as Jia Tan, with the nickname JiaT75 gained the trust of the developers. Jia Tan used sock puppetry to become co-maintainer of XZ Utils. They were able to release version 5.6.0 which included the backdoor. Jia Tan also released version 5.6.1, which added anomalous behaviour, that can be found using software testing.^[8]

There are other people suspected of sockpuppetry: Jigar Kumar, krygorin4545, and misoeater91. Probably these names, as well as the name Hans Jensen are pseudonyms. It is likely that there are no people with these names, and if there are, they have no connection to the project, apart from the code they contributed.^[14][15]

American security researcher Dave Aitel suggested that the approach fits the pattern attributable to APT29, an advanced persistent threat actor believed to be working on behalf of the Russian SVR.^[16] Others have suggested that it could be any state actor or a non-state actor of considerable resources.^[17]

The US federal agency responsible for cyber security and infrastructure, the Cybersecurity and Infrastructure Security Agency, issued a security advisor. It recommends a previous uncompromised version should be installed on affected devices.^[18] Linux software vendors, including Red Hat, SUSE, and Debian, have mirrored the CISA advisory, and reverted the updates for the affected packages to older versions.^[13][19][20] GitHub has disabled the mirrors for the xz repository.^[21]

Computer scientist Alex Stamos said that "this could have been the most widespread and effective backdoor ever planted in any software product". He noted that the backdoor would have "given its creators a master key to any of the hundreds of millions of computers around the world that run SSH", if it had not been found.^[22] In addition, the incident also started a discussion regarding the viability of having critical pieces of cyberinfrastructure depend on unpaid volunteers.^[23]

• Official website
• Andres Freund's report to the Openwall oss-security mailing list