Red Hat Enterprise Linux 10: Embedded Malicious Code
CVE-2024-3094 is a critical-severity embedded malicious code vulnerability in Red Hat Enterprise Linux 10 from Red Hat, with a CVSS 3.1 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 90.9% chance of exploitation within 30 days, which is in the top 0.19% of all scored CVEs.
Exploitation in the next 30 days is more likely than not, according to EPSS.
What to do
- Check which version of Red Hat Enterprise Linux 10 you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on access.redhat.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 6 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 7 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9 | Not specified in the record | Not stated |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | Not specified in the record | Not stated |
| Tukaani | Xz | 5.6.0; 5.6.1 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 10.0 | Critical | CNA (redhat.com) |
| CVSS 3.1 | 10.0 | Critical | NVD |
Official description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How developers prevent this class of flaw
- Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
- access.redhat.com/security/cve/CVE-2024-3094
- bugzilla.redhat.com/show_bug.cgi?id=2272210Issue Tracking
- redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
- aws.amazon.com/security/security-bulletins/AWS-2024-002/Third Party Advisory
- bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024Mailing List
- github.com/advisories/GHSA-rxwq-x6h5-x525Third Party Advisory
- tukaani.org/xz-backdoor/Issue Tracking
Third-party and government advisories
- arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/Third Party Advisory
- boehs.org/node/everything-i-know-about-the-xz-backdoorThird Party Advisory
- bugs.gentoo.org/928134Issue Tracking, Third Party Advisory
- bugzilla.suse.com/show_bug.cgi?id=1222124Issue Tracking, Third Party Advisory
- discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405Third Party Advisory
- gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27Third Party Advisory
- github.com/karcherm/xz-malwareThird Party Advisory
- gynvael.coldwind.pl/?lang=en&id=782Technical Description, Third Party Advisory
- lists.debian.org/debian-security-announce/2024/msg00057.htmlMailing List, Third Party Advisory
- lists.freebsd.org/archives/freebsd-security/2024-March/000248.htmlThird Party Advisory
- lwn.net/Articles/967180/Issue Tracking, Third Party Advisory
- news.ycombinator.com/item?id=39865810Issue Tracking, Third Party Advisory
- openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/Third Party Advisory
- security-tracker.debian.org/tracker/CVE-2024-3094Third Party Advisory
- security.alpinelinux.org/vuln/CVE-2024-3094Third Party Advisory
Other references
- openwall.com/lists/oss-security/2024/03/29/4Mailing List
- openwall.com/lists/oss-security/2024/03/29/10
- openwall.com/lists/oss-security/2024/03/29/12
- openwall.com/lists/oss-security/2024/03/29/4
- openwall.com/lists/oss-security/2024/03/29/5
- openwall.com/lists/oss-security/2024/03/29/8
- openwall.com/lists/oss-security/2024/03/30/12
- openwall.com/lists/oss-security/2024/03/30/27
- openwall.com/lists/oss-security/2024/03/30/36
- openwall.com/lists/oss-security/2024/03/30/5
- openwall.com/lists/oss-security/2024/04/16/5
- ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
- blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
- github.com/amlweems/xzbot
- news.ycombinator.com/item?id=39877267Issue Tracking
Other vulnerabilities in Red Hat Enterprise Linux 10
- 8.8 High severity
- 7.5 High severity
- 7.5 High severity
- 7.9 High severity
- 7.3 High severity
- 7.5 High severity
Recent Embedded Malicious Code vulnerabilities
- 9.8 Critical severity
Spotted an error? Tell us.