CVE-2024-3094

The malicious code is hidden in a disguised test file contained in the source code. During the liblzma library build process, an extraction script retrieves a precompiled binary object from this file and uses it to modify selected functions in the liblzma library. As a result, a modified version of the library is created that intercepts and modifies data exchanged by software using this library. The entire mechanism is based on a series of complex obfuscation techniques, which makes detection of malicious code difficult during standard inspection.

An attacker can intercept and modify data processed by any software linked with the infected liblzma library, which in practice can lead to unauthorized access, violation of data confidentiality and integrity, and in the worst case scenario to remote code execution (RCE).

The xz/liblzma library should be immediately downgraded to a version preceding 5.6.0 (e.g., 5.4.x) or patches available from the distribution vendor should be applied according to references. Red Hat issued an urgent security alert for Fedora 41 and Rawhide users — follow the guidelines provided by your distribution vendor.

The xz library (liblzma) in versions 5.6.0 and newer, distributed as official source archives (tarballs) by the Tukaani project; affects any system or software that was built using the vulnerable version of the library