CyberzSOC

XZ Utils is a data compression software and may be present in Linux distributions. The malicious code may allow a Threat Actor, with the right authentication key, to achieve gated pre-auth RCE on affected systems. [1] It is recommended downgrading XZ Utils to a not compromised version. [Updated] The issue is tracked as CVE-2024-3094, with a CVSS score of 10 out of 10. The malicious code interferes with authentication in sshd via systemd . Under the right circumstances, this interference allows someone with the right private key to hijack the sshd process and from there to execute commands on the targeted system. [1] [New] The execution chain also consists of multiple stages [7]: the “test” file bad-3-corrupt_lzma2.xz into a bash script. good-large_compressed.lzma , decoding it into another script compilation process of liblzma The shared object itself is compiled into liblzma , and replaces the regular function name resolution process. The malicious library interferes with the function resolving process, so it could replace the function pointer for the OpenSSH function RSA_public_decrypt .