xz/liblzma Supply-Chain Backdoor (CVE-2024-3094) — Critical Linux Vulnerability

CVE-2024-3094 is a malicious backdoor inserted into upstream xz / liblzma tarballs (versions 5.6.0 and 5.6.1). On systems where the compromised library is linked into sshd via systemd/liblzma, attackers could potentially intercept SSH authentication — a rare but severe supply-chain incident.

Known bad versions

• xz 5.6.0 and 5.6.1 (upstream tarballs only — most stable distros never shipped these)
• Homebrew, rolling distros, or manual builds from affected tarballs

Audit commands

xz --version
rpm -q xz-libs 2>/dev/null || dpkg -l liblzma5
strings $(which sshd) | grep -i xz || true

What to do

• Downgrade to xz 5.4.x or install vendor-fixed packages
• Rebuild sshd against clean liblzma if you compiled from source
• Pin package versions until your OS vendor confirms safety
• Review CI/CD and third-party tarball downloads for xz updates

This advisory remains relevant for anyone maintaining custom Linux images or rolling-release servers.