XZ Utils Backdoor 2024 (CVE-2024-3094): How a Trusted Maintainer Identity Nearly Backdoored SSH Across Linux

On 29 March 2024, a Microsoft engineer investigating a small performance problem uncovered one of the most carefully planned software supply chain attacks yet seen. Versions 5.6.0 and 5.6.1 of XZ Utils, a compression library present on almost every Linux system, contained a backdoor that could let an attacker holding a specific private key bypass SSH authentication and run code remotely. It had been planted by "Jia Tan", a contributor who spent more than two years earning maintainer rights. The backdoor was caught before it reached most stable Linux releases. The lesson is about trust: in maintainer accounts, release processes and the authentication that SSH itself depends on.

At a glance

What happened

XZ Utils had long been maintained largely by one volunteer, Lasse Collin. From 2021, a contributor using the name Jia Tan began submitting patches. Over the following years, other accounts with no visible history in software development pressed Collin to hand over more responsibility, in what is now widely described as a sock-puppet pressure campaign. Jia Tan gradually gained commit access and, according to the community write-up that tracked the incident, release manager rights about a year and a half before the backdoor was found.

XZ Utils 5.6.0 was released on 26 February 2024, followed by 5.6.1. Both contained a backdoor. The malicious code was not in the project's git source that most reviewers would read. It lived in the release tarballs, in a modified build-to-host.m4 build macro, and in binary test files that carried the payload. During the build, the modified script extracted and inserted the payload into liblzma.

On distributions where OpenSSH's server is linked to systemd, which in turn loads liblzma, the backdoor could hook sshd's authentication. Red Hat's assessment, quoted by Rapid7, is that it "interferes with authentication in sshd via systemd" and "could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely". Access required a key that the payload verified before passing attacker input to the system, so only the holder of that key could use it.

Andres Freund, a Microsoft engineer and PostgreSQL developer, noticed that SSH logins on a Debian development system were using unexpectedly high CPU and producing errors in memory debugging tools. He traced the cause to liblzma and reported it to the linux-distros and oss-security lists on 29 March 2024. Distributions rolled back the affected versions within days, CISA advised users to roll back to an uncompromised version, and the Jia Tan account was removed from the project on 31 March.

Timeline

How it happened: the identity attack path

1. Build a trusted identity. The attacker invested years in a contributor persona, making useful changes and building a reputation.
2. Apply social pressure. Supporting accounts pushed an overstretched maintainer to add help, speeding up the transfer of trust.
3. Gain release rights. Commit and release manager rights meant the attacker controlled what went into the official release tarballs that distributions package.
4. Hide the payload outside reviewed code. The malicious logic sat in a build macro and in binary test files, places that code review and git diffs rarely examine closely.
5. Target authentication itself. Through liblzma and systemd, the payload hooked sshd's authentication so that a holder of the attacker's key could gain remote code execution on any affected server exposing SSH.

Impact

• Exposure: the backdoor reached development and rolling-release distributions, including Fedora Rawhide and Fedora 40 beta, Debian unstable, Kali Linux, openSUSE Tumbleweed and MicroOS, and Arch Linux. Rapid7 lists Ubuntu, Alpine, Amazon Linux, RHEL, Gentoo and Linux Mint as unaffected.
• Near miss: had it reached stable enterprise releases, it could have given its owner remote access to a very large number of internet-facing Linux servers.
• Response: emergency rollbacks across distributions and CISA guidance to roll back to an uncompromised version.

What this means for NHI governance

XZ Utils is not a classic stolen-secret breach, but it is fundamentally about trust in identities that machines rely on. Distributions trust release tarballs because they come from the project's maintainers. Servers trust sshd to verify keys correctly. The attacker targeted both: first by becoming a trusted release identity, then by corrupting the code that checks machine and user keys at login.

For organisations, the practical parallels are in their own pipelines. Build systems, release accounts, signing keys and package publishing tokens are non-human identities with enormous reach. When they are shared, long-lived or held by a single overstretched person, they become targets for patient attackers. Several recent incidents on our timeline, such as the SpotBugs token behind the GitHub supply chain attack and the Shai-Hulud npm campaign, show attackers going after maintainer and publishing credentials directly.

The discovery also shows the value of behavioural signals. The backdoor was found because authentication behaved slightly differently, taking more CPU than it should. Monitoring how machine authentication behaves, not just whether it succeeds, can surface tampering that code review misses.

Recommendations

• Verify what you build. Build packages from source you can review, compare release artefacts with the tagged source, and adopt build provenance (for example SLSA attestations) for critical dependencies.
• Protect release and publishing identities. Require strong authentication, separate release rights from everyday commit access, and use short-lived, scoped publishing tokens. See our NHI Authentication Guide.
• Limit single points of trust. Critical releases should need more than one person or key to approve.
• Harden SSH access. Limit which servers expose SSH to the internet, prefer short-lived SSH certificates over static keys, and monitor authentication behaviour and performance.
• Track dependencies and react fast. Keep a software bill of materials so you can find affected systems within hours when a supply chain issue is disclosed.
• Keep secrets out of build systems. A compromised build step should not find reusable credentials. Our guide to the secret sprawl challenge explains why.

Frequently asked questions

What was the XZ Utils backdoor?

Malicious code in XZ Utils versions 5.6.0 and 5.6.1 (CVE-2024-3094) that, on certain Linux systems, hooked OpenSSH server authentication and could allow remote code execution by an attacker holding a specific private key.

Who discovered the XZ Utils backdoor?

Andres Freund, a Microsoft engineer, who noticed unusual CPU use and memory-tool errors during SSH logins on a Debian development system and reported it on 29 March 2024.

Why does the XZ Utils backdoor matter for identity security?

The attacker spent years building a trusted maintainer identity to gain release rights, then targeted the code that checks keys at SSH login. Release identities, publishing tokens and machine authentication paths all need the same protection as privileged accounts.

Related NHI Mgmt Group resources

GitHub Action supply chain attack · PyPI breach · Codecov breach · NHI Lifecycle Management Guide

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target publishing tokens, signing keys, SSH keys and the build systems that trust them. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.

References

• Andres Freund: backdoor in upstream xz/liblzma leading to ssh server compromise (oss-security, 29 March 2024)
• Rapid7: Backdoored XZ Utils (CVE-2024-3094) (1 April 2024)
• Sam James: xz-utils backdoor situation (CVE-2024-3094), community FAQ
• Datadog Security Labs: The XZ Utils backdoor (CVE-2024-3094): Everything you need to know, and more (3 April 2024)
• Wikipedia: XZ Utils backdoor, for the CVSS rating and the pressure campaign timeline