maliciousCovers 5.6.0Reviewed by BitbisonUpdated 2026-10-15
In 2024, the xz-utils 5.6.0 release tarball shipped with a covertly injected backdoor.
Summary
XZ Utils provides compression tools and the liblzma library. Its 5.6.0 and
5.6.1 release archives contained a backdoor that injected a precompiled object
into liblzma during selected builds. This account explains the affected
releases and the build evidence recorded by Bitbison.
Upstream records date the releases to February 24
and March 9, 2024. Maintainer Lasse Collin confirmed that Jia Tan created and
signed both archives. They contained a modified m4/build-to-host.m4 absent
from the Git repository; the two test files carrying the hidden scripts and
object code were present in Git.
Upstream incident account.
Andres Freund disclosed the backdoor on the oss-security mailing list on
March 29 after investigating unusual processor use and memory-checking errors
during Secure Shell (SSH) logins on Debian unstable. The injection targeted
selected x86-64 Linux builds and checked the compiler, linker and packaging
environment. Some distributions' SSH servers loaded liblzma indirectly through
libsystemd.
Kaspersky's analysis documented how the backdoor intercepted cryptographic
functions such as RSA_public_decrypt on susceptible systems. It accepted
commands signed with the attacker's private key, allowing authentication
bypass or remote command execution.
Where it reached
Affected source releases reached development branches and rolling distributions:
- Fedora Rawhide, then the development branch for Fedora 41, received affected
versions. Fedora 40 beta also contained affected source versions, although
Red Hat said the injection did not appear to take effect in those builds.
Red Hat advisory.
- Debian reported compromised packages in testing, unstable and experimental.
Debian advisory.
- openSUSE Tumbleweed and MicroOS included the affected version between
March 7 and March 28.
openSUSE advisory.
- Kali's March 29 advisory reported that the affected package was available
between March 26 and March 29.
- Ubuntu's affected version remained in
noble-proposed, the testing area
for Ubuntu 24.04, and was removed before entering the release pocket.
Ubuntu advisory.
Debian stable, Red Hat Enterprise Linux and released Ubuntu versions were
unaffected according to their advisories. Canonical rebuilt Noble packages
built after February 26 in fresh environments and delayed the Ubuntu 24.04
beta from April 4 to April 11.
Canonical's rebuild announcement.
What Bitbison saw
We built the affected 5.6.0 release archive in our lab. The
recorded run
contains two findings: an edited build file and an object whose origin could
not be verified as source compilation. Their evidence shows this sequence:
sed edited src/liblzma/Makefile in place to reference the planted test
file bad-3-corrupt_lzma2.xz.- The other planted file,
good-large_compressed.lzma, passed through
xz, head, sed, awk, a second xz process and a final head
process. The final head wrote liblzma_la-crc64-fast.o.
- The linker incorporated that extracted object into
.libs/liblzma_la-crc64_fast.o. The hyphenated crc64-fast.o input
carried the precompiled payload; the underscored crc64_fast.o was the
resulting link output.
The report associates the object-origin finding with liblzma.so.5.6.0 and
the xz, xzdec and lzmainfo artifacts. This is evidence of the modified
build. It does not demonstrate exploitation of an SSH server.
References
