10 CVE-2024-3094
Enriched by CISA Exploit
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
https://nvd.nist.gov/vuln/detail/CVE-2024-3094
Categories
CWE-506 : Embedded Malicious Code
Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.
References
af854a3a-2127-422b-91ae-364da2661108
secalert@redhat.com
| https://access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue Tracking Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2024/03/29/4 Mailing List |
| https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users Vendor Advisory |
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| N/A | N/A |
|
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | |
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:* | ||
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| https://github.com/byinarie/CVE-2024-3094-info |
| https://github.com/MrBUGLF/XZ-Utils_CVE-2024-3094 |
| https://github.com/Juul/xz-backdoor-scan |
| https://github.com/shefirot/CVE-2024-3094 |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 442 | Infected Software |
High |
| 448 | Embed Virus into DLL |
High |
| 636 | Hiding Malicious Data or Code within Files |
High |
MITRE
Techniques
| id | description |
|---|---|
| T1001.002 | Data Obfuscation: Steganography |
| T1027.003 | Obfuscated Files or Information: Steganography |
| T1027.004 | Obfuscated Files or Information: Compile After Delivery |
| T1027.009 | Obfuscated Files or Information: Embedded Payloads |
| T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools |
| T1195.002 | Supply Chain Compromise: Compromise Software Supply Chain |
| T1218.001 | Signed Binary Proxy Execution: Compiled HTML File |
| T1221 | Template Injection |
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | |
Mitigations
| id | description |
|---|---|
| M1031 | Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level. |
| M1040 | On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts. |
| M1016 | Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well. |
| M1016 | Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well. |
| M1021 | Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files |
| M1017 | Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents. |
| © 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation. | |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
