# CVE-2024-3094 ## Identification CVE-2024-3094 is the 2024 XZ Utils supply-chain backdoor incident affecting upstream releases 5.6.0 and 5.6.1. It was an intentional compromise of release and build machinery, not an ordinary accidental programming defect. ## Technical mechanism Malicious material was concealed in upstream release artifacts and activated through the build process under selected conditions. The resulting code modified `liblzma` behavior on targeted x86-64 Linux environments. In particular distribution configurations, `liblzma` could enter the dependency path of `sshd` through system libraries, giving the backdoor a conditional route toward SSH authentication handling. This was a supply-chain attack across several boundaries: **upstream trust → release artifact → build scripts and test files → compiled library → transitive system dependency → security-critical service** The affected versions had not yet become universal stable-distribution defaults. The incident was nevertheless globally consequential because it showed how a quiet compression library, compromised upstream, could approach a remote-access trust boundary across large parts of the Linux ecosystem. ## Discovery Andres Freund disclosed the issue on March 29, 2024 after investigating anomalous CPU consumption and latency associated with SSH logins. His analysis traced the behavior from `sshd` into the modified `liblzma` path and found obfuscated injected code. The discovery is itself a provenance lesson: a small runtime anomaly exposed a compromise that conventional attention to the visible application might have missed. ## Earlier notebook relationship [[Scanned_20260730-1946]], PDF page 7, circles `XZ` inside a manually reconstructed dependency graph. PDF page 20 records the exact upstream URL `tukaani.org/xz/` and “the tukaani project.” These notes predate the 2024 incident. **Owner-supplied retrospective clarification:** Bryant McGill states that his early attention was intentional. At the time of writing, he believed XZ/Tukaani occupied its dependency position deliberately and formed part of a larger [[Surveillance|surveillance architecture]]. He says he held that view before the backdoor was publicly known and before others, in his assessment, recognized an intentional issue at that layer. ## Evidentiary boundary The notebook did not identify versions 5.6.0 or 5.6.1, the build-stage mechanism, malicious test artifacts, `liblzma` injection, an SSH authentication path, the later maintainer history, or CVE-2024-3094 itself. The 2024 incident therefore does not prove that the owner's earlier model described the same actors, operation, or surveillance purpose. What the later incident does establish is narrower and important: **the dependency layer the notebook had already isolated was capable of intentional upstream subversion and security-critical transitive reach**. That makes the notebook record an early architectural suspicion with strong hindsight significance, not a technical identification of the later payload. ## Relationships [[XZ Utils]] · [[Tukaani Project]] · [[Software Supply-Chain Provenance]] · [[Software Bill of Materials]] · [[Surveillance]] ## Sources - [Original oss-security disclosure by Andres Freund](https://www.openwall.com/lists/oss-security/2024/03/29/4) - [NVD — CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) - [Tukaani Project — XZ Utils backdoor](https://tukaani.org/xz-backdoor/) - [CISA — Reported Supply Chain Compromise Affecting XZ Utils](https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094)