# Backdoor in XZ Utils allows RCE: everything you need to know

Malicious build-time backdoor in XZ Utils 5.6.0/5.6.1 hooks RSA_public_decrypt in liblzma, letting an attacker with a signed payload run commands via sshd.

- Payout: Research
- Severity: critical
- Program: XZ Utils
- Credited: Wiz Research
- Disclosed: 2024-03-29
- CVE: CVE-2024-3094
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils
- Tags: domain:infra domain:oss impact:rce kind:research platform:threat-intel sev:critical tech:linux technique:reverse-engineering technique:source-review vuln:rce

**Target:** liblzma / OpenSSH sshd on systemd-linked Linux distros
**Root cause:** Obfuscated test files in the source tarball are extracted during liblzma build via a malicious M4 macro, injecting a precompiled object that redirects RSA_public_decrypt to attacker code.
**Steps:**
1. Build xz 5.6.0/5.6.1 as part of a Debian/RPM package build on x86-64 Linux so the malicious M4 macro triggers
2. Backdoor hooks RSA_public_decrypt (fallbacks EVP_PKEY_set1_RSA, RSA_get0_key) in liblzma
3. Send an SSH publickey auth attempt whose key blob carries a signed command payload
4. Backdoor verifies signature and passes payload to libc `system()`
5. Backdoor swaps in a hardcoded fake RSA key or hooks sshlogv to hide the attempt from verbose logs
**How found:** Andres Freund noticed sshd consuming unexpectedly high CPU during logins and Valgrind errors while profiling, prompting deeper investigation that uncovered the backdoor.
**Exploitation:** Attacker connects to sshd on a vulnerable host and supplies a crafted RSA public key containing a signed command; the hooked RSA_public_decrypt extracts, verifies and executes it via system(), yielding RCE as the sshd user (root).
**Escalation:** Anti-debugging checks (rr/gdb), runtime gating on argv[0]=/usr/sbin/sshd, TERM unset, LANG set, and log-hiding methods reduce detection and analysis.
**Insight:** Anomalous CPU/latency in a well-understood daemon plus tooling (Valgrind) breaking on it is a strong signal of injected code; also check build scripts (M4/configure) and test fixtures in release tarballs, not just git.