XZ Utils Supply Chain Backdoor (CVE-2024-3094)

On March 29, 2024, Microsoft engineer Andres Freund disclosed that xz/liblzma versions 5.6.0 and 5.6.1 contained a deliberately inserted backdoor (CVE-2024-3094). The backdoor was introduced by a long-term contributor known as “Jia Tan” (JiaT75) who had spent roughly two years building trust in the xz project before executing the attack.

The backdoor modified the RSA key decryption process in liblzma, which OpenSSH links through systemd on affected systems. When exploited with a specific hidden key, it would allow unauthenticated remote code execution. Freund noticed the backdoor while investigating unexpected CPU usage and SSH authentication slowness on a Debian testing system.

The compromised versions reached several rolling-release and testing distributions (Fedora 40/41 beta, Debian testing, Arch, openSUSE Tumbleweed) but not any stable/LTS distributions before discovery. The multi-year social engineering campaign and the sophistication of the backdoor drew significant attention to supply chain risks in open source software.