On 29 March 2024, software developer Andres Freund reported that he had found a maliciously introduced backdoor in the Linux utility xz within the liblzma library in versions 5.6.0 and 5.6.1 released in February 2024.

xz is a software that is present in most Linux distributions. It is used for compressing and decompressing data. Liblzma is a library, a piece of software that other programs can use. It allows to compress and decompress using the Lempel–Ziv–Markov chain algorithm. The backdoor targeted systems runningDebian- and RPM-based systems running on the x86-64 architecture. At the time of discovery the backdoored version had not yet been widely deployed.

Using the backdoor, an attacker who has a specific Ed448 private key can get remote code execution capabilities on the affected Linux systems. The issue has been assigned a CVSS score of 10.0, the highest possible score.

Background
----------

The Microsoft employee and PostgreSQL developer Andres Freund reported the backdoor after investigating a performance regression in Debian Sid. Freund noticed that SSH connections were generating an unexpectedly high amount of CPU usage as well as causing errors in Valgrind, a memory debugging tool. Freund reported his finding to Openwall Project's open source security mailing list. This brought it to the attention of various software vendors. There is evidence that the attacker made efforts to hide the code. The backdoor is made of multiple stages that act together.

When the compromised version is incorporated into the operating system, it changes the behavior of OpenSSH's SSH server daemon. It abuses the systemd library, allowing the attacker to gain the same level of access as any authorized administrator. According to the analysis by Red Hat, the backdoor can "enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely".

An investigation found that inserting the backddor was a big effort: It took about three years. A user known as

*Jia, with* the nickname JiaT75 gained the trust of the developers. *Jia Tan used t sock puppetry to become co-maintainer of f XZ Utils. He or she was able to release the version 5.6.0, which included the backdoor. Jia Tan also released version 5.6.1, which added anomalous behaviour, that can be found using software testing.*

There are other people suspected of sockpuppetry: *Jigar Kumar*, *krygorin4545*, and *misoeater91. Probably, these names, as well as the name Hans Jensen are pseudonyms. It is likely that there are no people with these names, and if there are, they have no connection to the project, apart from the code they contributed.*

The backdoor was notable, because it was very sophisticated. Also, there was a high level of 

The backdoor was notable for its level of operational security, for the time needed to get the trust of the developers. 

American security researcher Dave Aitel has suggested that it fits the pattern attributable to APT29, an advanced persistent threat actor believed to be working on behalf of the Russian SVR. Others  have suggested that it could be any state actor or a non-state actor of considerable resources.

Response
--------

### Immediate fixes

The US federal agency responsible for cyber security and infrastructure, the Cybersecurity and Infrastructure Security Agency, has issued a security advisor. It recommends a previous uncompromised version should be installed on affected devices. Linux software vendors, including Red Hat, SUSE, and Debian, have mirrored the CISA advisory, and reverted the updates for the affected packages to older versions. GitHub has disabled the mirrors for the xz repository.

### Broader response

Computer scientist Alex Stamos said that "this could have been the most widespread and effective backdoor ever planted in any software product". He noted that the backdoor would have "given its creators a master key to any of the hundreds of millions of computers around the world that run SSH", if it had not been found. In addition, the incident also started a discussion regarding the viability of having critical pieces of cyberinfrastructure depend on unpaid volunteers.

Other websites
--------------

* Official website
* Andres Freund's report to the Openwall oss-security mailing list