Malicious code was discovered in the upstream tarballs of xz starting with version 5.6.0. The liblzma build process extracts a disguised prebuilt object file from a test file in the source code, which modifies specific liblzma functions. This results in a modified liblzma library that can intercept and modify data interactions for any software linked against it. The malicious injection is present only in the tarball download packages for versions 5.6.0 and 5.6.1, and not in the Git repository. The issue affects Fedora 41 and Fedora Rawhide but not Red Hat Enterprise Linux. The malicious code was demonstrated to interfere with OpenSSH daemon via systemd, which links to liblzma. The vulnerability has a CVSS 3.1 score of 10.0 (critical) with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

This vulnerability allows execution of unauthorized code or commands by modifying the liblzma library used by software linked against it. It can intercept and alter data interactions, potentially compromising confidentiality, integrity, and availability of affected systems. The CVSS score of 10.0 reflects critical impact with full compromise possible remotely without authentication or user interaction. The malicious code presence in the widely used xz compression library source tarballs poses a significant supply chain risk. However, Red Hat Enterprise Linux versions are not affected, limiting exposure primarily to Fedora 41 and Rawhide users.

Red Hat has stated that no versions of Red Hat Enterprise Linux are affected, and the malicious code is only present in the tarball downloads of xz versions 5.6.0 and 5.6.1, not in the Git repository. Users of Fedora 41 and Fedora Rawhide should avoid using the affected tarball versions and obtain xz from trusted sources or updated packages once available. Since no official patch or fix is currently referenced, users should monitor the vendor advisories from Red Hat and AWS for updates. There is no indication that the malicious code is present in official RHEL builds, so no action is required for RHEL users. Check vendor advisories for current remediation guidance.