XZ Utils backdoor

Red Hat is now tracking this supply chain security issue as CVE-2024-3094... The malicious code is obfuscated and can only be found in the complete download package, not in the Git distribution, which lacks the M4 macro, which triggers the backdoor build process.

Malicious code was found in XZ source packages beginning with release 5.6.0; a concealed test file is used during the liblzma compilation process to extract a precompiled object file and alter liblzma functions.

If the payload successfully passes verification steps and signature checks, it is then transferred to libc's system() function. This function is designed to execute the payload.

If the malicious macro is present, the second-stage artifacts found in the Git repository are injected during the build time.

The script mainly aims to modify the MakeFile of liblzma in order to interfere with its symbol resolution process in runtime, particularly causing the RSA_public_decrypt symbol to point to its own malicious backdoor code.

Through a series of complex obfuscations, a concealed test file within the source code is used during the liblzma compilation process to extract a precompiled object file.

After performing the command sent by the attacker, the backdoor replaces the public RSA key object with a prebuilt constant key; alternatively, it replaces log entries describing successful connections with entries describing failed connection attempts.

If the malicious macro is present, the second-stage artifacts found in the Git repository are injected during the build time.

The script mainly aims to modify the MakeFile of liblzma in order to interfere with its symbol resolution process in runtime, particularly causing the RSA_public_decrypt symbol to point to its own malicious backdoor code.

During the public key authentication process of sshd, the RSA_public_decrypt function gets called, causing the attacker's code to be executed. This code attempts to extract a payload from the public key passed to it during authentication.

The resulting malicious build interferes with authentication in sshd via systemd... Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.