XZ Utils backdoor CVE-2024-3094 (liblzma 5.6.0 and 5.6.1): how do I check if I have the malicious versions and what do I do?

What it is: CVE-2024-3094 is malicious code that was found in the upstream release tarballs of XZ Utils starting with 5.6.0 (March 2024, publicly disclosed March 29). The tarball build process extracted a hidden prebuilt object from a disguised test file and modified functions in liblzma, so software linked to it (notably sshd on some distributions via systemd) could have data intercepted or altered. It was a supply-chain compromise caught before wide stable-distro rollout. NVD scores it 10.0; NVD's CISA data lists exploitation as none, and it is not described as a KEV entry in the sources used here. Am I affected: - Only xz/liblzma 5.6.0 and 5.6.1 built from the compromised tarballs. The xz maintainers say those release tarballs contain the backdoor. - Red Hat lists its RHEL releases as unaffected; the issue mainly touched development or testing branches such as Fedora 41/Rawhide, Debian testing/unstable and similar rolling distributions. - Check: xz --version, and your package manager (for example dpkg -l xz-utils liblzma5, rpm -q xz xz-libs). Fix: 1. If you have 5.6.0 or 5.6.1, downgrade or update to the distribution's fixed package. CISA recommended reverting to a clean release such as 5.4.6 Stable. Use your distribution's security update, not a hand-built tarball. 2. Investigate systems that ran affected builds for signs of compromise, and report positive findings to CISA if you are in scope. 3. If an affected build ran on an internet-facing host with SSH reachable, treat it as possibly compromised: rebuild from a clean image if there is evidence of misuse, and rotate SSH host keys, user keys and other secrets from that host. Verify: xz --version and the package query report a version other than 5.6.0/5.6.1 from your distribution's fixed package. Sources: https://tukaani.org/xz-backdoor/ https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 https://nvd.nist.gov/vuln/detail/CVE-2024-3094