# MA-1057.042024: MyCERT Advisory - xz-utils Backdoor Found in Kali Linux Installations

**Date:** 05 Apr 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1057.042024  
**Advisory ID:** MA-1057.042024

---

**1.0 Introduction**
Recently, Red Hat Linux disclosed CVE-2024-3094, marked with a critical CVSS score of 10. This vulnerability stems from a supply chain compromise affecting the most recent editors of XZ tools and libraries. XZ Utils, a data compression software widelt integrated into major Linux distributions, is impacted. Version 5.6.0 and 5.6.1 of these libraries harbor malicious code that alters functions during the liblzma build process. Liblzma, the compression library, is thus compromised. This malicious code enables the tampered liblzma library to potentially manipulate or intercept data from other applications reliant on it, potentially leading to unauthorized access under specific circumstances. The discovery of this issue was credited to security researcher Anders Freund, who identified the malicious code while investigating failed SSH logins accompanied by high CPU loads. This observation prompted further scrutiny, ultimately revealing the vulnerability’s existence.
**2.0 Impact**
This backdoor could potentially allow a malicious actor to compromise ssh authentication, granting unauthorized access to the entire system remotely.
**3.0 Affected Versions**
|  | --- | --- | **DEBIAN** | - Branches: Bookworm, Trixie, SID - Affected packages: xz-utils 5.5.1 alpha-0.1 through 5.6.1-1 | **FEDORA** | - Branches: 40, 41, Rawhide - Affected packages: xz-5.6.0-\*, xz-5.6.1-\* | **OPENSUSE** | - Branches: Tumbleweed - Affected packages: xz-5.6.0, xz-5.6.1 | **KALI** | - Affected packages: xz-utils 5.6.0-0.2 | **ALPHINE** | - Branches: Edge (active development) - Affected packages: xz 5.6.1-r0, 5.6.1-r1 | **ARCH** | - Affected packages: xz 5.6.0-1 |
**4.0 Technical Details**
On March 29, a significant vulnerability involving remote code execution was identified in a software dependency affecting multiple Linux distributions. This vulnerability stems from the inclusion of malicious code within the xz compression utility, which serves as a crucial component for OpenSSH in numerous distributions. This illicit code was detected in a recent version of xz, designed to operate solely within specific cryptographic key to bypass authentication on the targeted host.
The inserted backdoor code was present in xz builds released between March 26 and March 29. It was added by a developer account that has contributed to the xz project for several years. The advanced nature and targeted intent behind this code strongly suggest the involvement of a nation-state actor. While the full extent of the attack remains uncertain, current information indicated that only development and cutting-edge version Debian, Fedora, OpenSuse, Kali, Alphine, and Arch Linux distributions are impacted.
To check the vulnerable version installed, perform the following command:
*Figure 1: Command to check version installed.*
If the version installed is 5.6.0-0.2 shows next to Installed: then must upgrade to the latest version, 5.6.1+really5.4.5-1, perform the following command: 
*Figure 2: Command to update the vulnerable version.*5.0 Recommendations**
CyberSecurity Malaysia recommend users and administrators to review the following mitigation and apply the necessary updates:
|  | --- | --- | Version | Remediation | DEBIAN | Update to latest version (5.6.1+really5.4.5-1) | FEDORA | FC40- Update (v 5.4.x). FC41 & Rawhide – Stop using immediately | OPENSUSE | Update to latest version (5.6.1.revert to 5.4) | KALI | Kali installations updated between March 26th to March 29th , update to latest version (5.6.1+really5.4.5-1) | ALPHINE | Update to latest version (5.6.1-r2) | ARCH | Update to latest version (5.6.1-2) |
CyberSecurity Malaysia also encourages users and administrators to review the following cyber security best practices:
- Keep computers, devices, and applications updated and patched.
- Avoid using beta, development, or cutting-edge versions of software; stick to stable, production versions.
- Ensure that automatic updates are turned on for all products.
- Update affected products as soon as patches are released or implement any recommended workaround until a patch is released.
- Avoid using development version of operating systems in production. Use versions which are designated “stable,” “production,” “LTS,” or similar.
- Educated the staffs. As an organization should educated the staffs to improve the ability to detect unusual or unauthorized behaviour whenever prevention fails.
- Use tools to check the dependency trees for vulnerabilities.
- It is important that any version that have deployed continues to have checks run against it since vulnerabilities may be found long after the build and deploy steps.
- Set up automated jobs to run those checks and report any issues on repeating schedule.
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
**6.0 References**
- <https://unit42.paloaltonetworks.com/threat-brief-xz-utils-cve-2024-3094/>
- <https://ciso.uw.edu/2024/04/01/xz-utils-linux/>
- <https://www.rapid7.com/blog/post/2024/04/01/etr-backdoored-xz-utils-cve-2024-3094/>
- <https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users>
- <https://www.kali.org/blog/about-the-xz-backdoor/>