Security Incidents
xz-utils Backdoor (CVE-2024-3094)
A build-time backdoor in liblzma, planted through a multi-year social engineering campaign against a single maintainer, and caught by a performance regression.
Why this entry is in a privacy and security archive
The backdoor’s interest is not that it was caught before use, which is a matter of research outcome, but that it shows the actual attack surface. A single unpaid volunteer was the weak point, and the attacker attacked the maintainer, not the code.
What was actually done
Three things, and the combination matters more than any of them:
- Social engineering over years. A convincing contribution history was built up over roughly two years, under pressure, using accounts in the project’s public space.
- Compromise of the build. The backdoor was placed in build configuration so that it was compiled into artefacts rather than visible in the library source. The malicious commits were identical across repositories in a way that betrayed the origin.
- Hooking a privileged service. The build artefacts hooked into
sshdthrough a systemd service patch, so that the backdoor ran in the SSH authentication path of every host that installed the package.
Discovery
The detection that led to the report was a performance regression: a syscall difference
observable in perf output, and an authentication attempt for a legitimate account that
failing in a way that should not have happened. Andres Freund followed the anomaly back
through the build path.
This is worth saying plainly: the near miss is a matter of luck plus a specific technical observation. There is no monitoring control that reliably detects a backdoor in this position.
No victim, no victim count
There is no primary record of exploitation against a specific organisation in the public disclosure. The affected packages were primarily development and rolling distribution channels. The correct statement is that the backdoor was found before verified exploitation in production systems, and this entry will be updated if that changes.
Sources
- NVD: CVE-2024-3094 — the canonical record.
- oss-security disclosure — the original technical description by the reporter, and the best available primary record.
- CISA advisory AA24-131A — the government response and affected distribution guidance.
Claim labels
FACT
The backdoor is tracked as CVE-2024-3094 in the National Vulnerability Database.
FACT
It was disclosed by Andres Freund on 29 March 2024 on the oss-security list, after he had privately reported it to affected distribution maintainers.
FACT
The affected versions are xz 5.6.0 and 5.6.1, and the backdoor is in liblzma, which is a dependency of an unusually large amount of the software ecosystem.
FACT
The backdoor was introduced in the build system, in a build script, rather than in the source of the compression library, and it hooked into sshd through a systemd service patch. Removing the binary artefacts does not remove the modified build path.
FACT
The backdoor was discovered through an unexplained performance and memory-related regression in sshd, and through the failure of a legitimate account to authenticate, rather than through a vulnerability report.
FACT
The two malicious commits, when hashed, produced the same SHA-1 commit object across all repositories, which is an artefact of the object database used by the hosting service and was one of the strongest available signals that the commits did not originate upstream.
RESEARCHER ANALYSIS
Independent analysis described the two-year campaign attributed to the persona "Jia Tan", the pressure applied to the maintainer, and the long tail of deliberately innocuous commits. The maintainer, Lasse Collin, has stated that he was not aware the changes were malicious and that he was under substantial pressure from a third party claiming to work with security researchers.
FACT
Red Hat, Debian, Fedora, Ubuntu, SUSE, openSUSE, and others shipped or avoided the affected development packages. Some distributions reverted the packages as a precaution, and some rewrote the affected files because the tarball artefacts were not a complete description of the change.
SOURCE CLAIM
There is no public primary record of who was behind the "Jia Tan" account or of the campaign behind it. Any attribution in circulation is inference, not disclosure.
Sources
Last link check: 2026-09-27. A link check confirms reachability, not that every claim has been independently reviewed.
- CVE-2024-3094 Accessed
- oss-security announcement: backdoor in xz 5.6.0 and 5.6.1 The original technical disclosure. Accessed
- CISA Advisory AA24-131A, Backdoor in XZ Utils Data Compression Library, CVE-2024-3094 Accessed