CVE-2024-3094: xz Supply Chain Infection

CVE-2024-3094 is a supply chain vulnerability in the xz compression library. Starting from version 5.6.0, the upstream build process contains malicious code hidden in seemingly innocent test files. During compilation, a prebuilt object file is extracted and modifies critical functions in liblzma. The result is a compromised library that can intercept, decrypt, and alter any data flowing through software that uses it: SSH, VPNs, backups, file compression, and many other critical services.

The vulnerability carries a CVSS score of 10.0 (maximum) and is classified as critical. It was discovered and disclosed on March 29, 2024, by security researchers. The obfuscation of malicious code is sophisticated: attackers embedded the object file in a disguised test tarball in the repository, making detection via source code review extremely difficult. Today, social signals report mentions of proof of concept, though these signals remain officially unverified. It remains one of the most severe open-source infrastructure compromises documented.

For defenders, priorities are immediate: 1) Inventory all systems with xz 5.6.0 or later, especially critical Linux servers (SSH, VPN, backup). 2) Verify liblzma.so integrity using official hashes from the xz project. 3) Apply security updates urgently to post-compromise versions. 4) Monitor logs and network behaviors for anomalous data interception patterns. Active exploitation investigation is recommended as part of immediate patching priorities.