CVE-2024-3094: Embedded Malicious Code
Published: Description Severity Notes Compute Engine is not affected by CVE-2024-3094 , which affects versions 5.6.0 and 5.6.1 of the xz-utils package in the liblzma library, and could lead to compromise of the OpenSSH utility. What should I do? Public images supported and offered by Compute Engine are not affected by this CVE. If you use Compute Engine public images for your VMs, no action is required. You could be at risk if you created a custom image that used versions 5.6.0 and 5.6.1 of xz-utils package, such as the following operating systems: Fedora 41 and Fedora Rawhide Debian testing/unstable openSUSE tumbleweed To mitigate this risk, stop any VMs that use these operating systems or others that could have used affected operating systems. If you have VMs built from custom images of other operating systems, check with your OS vendor to see if your VMs are affected. What vulnerabilities are being addressed? CVE-2024-3094 Medium CVE-2024-3094
AI Analysis
Technical Summary
Malicious code was discovered in the upstream tarballs of xz starting with version 5.6.0. The liblzma build process extracts a disguised prebuilt object file from a test file in the source code, which modifies specific liblzma functions. This results in a modified liblzma library that can intercept and modify data interactions for any software linked against it. The malicious injection is present only in the tarball download packages for versions 5.6.0 and 5.6.1, and not in the Git repository. The issue affects Fedora 41 and Fedora Rawhide but not Red Hat Enterprise Linux. The malicious code was demonstrated to interfere with OpenSSH daemon via systemd, which links to liblzma. The vulnerability has a CVSS 3.1 score of 10.0 (critical) with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
Potential Impact
This vulnerability allows execution of unauthorized code or commands by modifying the liblzma library used by software linked against it. It can intercept and alter data interactions, potentially compromising confidentiality, integrity, and availability of affected systems. The CVSS score of 10.0 reflects critical impact with full compromise possible remotely without authentication or user interaction. The malicious code presence in the widely used xz compression library source tarballs poses a significant supply chain risk. However, Red Hat Enterprise Linux versions are not affected, limiting exposure primarily to Fedora 41 and Rawhide users.
Mitigation Recommendations
Red Hat has stated that no versions of Red Hat Enterprise Linux are affected, and the malicious code is only present in the tarball downloads of xz versions 5.6.0 and 5.6.1, not in the Git repository. Users of Fedora 41 and Fedora Rawhide should avoid using the affected tarball versions and obtain xz from trusted sources or updated packages once available. Since no official patch or fix is currently referenced, users should monitor the vendor advisories from Red Hat and AWS for updates. There is no indication that the malicious code is present in official RHEL builds, so no action is required for RHEL users. Check vendor advisories for current remediation guidance.
CVE-2024-3094: Embedded Malicious Code
Description
Published: Description Severity Notes Compute Engine is not affected by CVE-2024-3094 , which affects versions 5.6.0 and 5.6.1 of the xz-utils package in the liblzma library, and could lead to compromise of the OpenSSH utility. What should I do? Public images supported and offered by Compute Engine are not affected by this CVE. If you use Compute Engine public images for your VMs, no action is required. You could be at risk if you created a custom image that used versions 5.6.0 and 5.6.1 of xz-utils package, such as the following operating systems: Fedora 41 and Fedora Rawhide Debian testing/unstable openSUSE tumbleweed To mitigate this risk, stop any VMs that use these operating systems or others that could have used affected operating systems. If you have VMs built from custom images of other operating systems, check with your OS vendor to see if your VMs are affected. What vulnerabilities are being addressed? CVE-2024-3094 Medium CVE-2024-3094
CVSS v3.1
Score 10.0critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Malicious code was discovered in the upstream tarballs of xz starting with version 5.6.0. The liblzma build process extracts a disguised prebuilt object file from a test file in the source code, which modifies specific liblzma functions. This results in a modified liblzma library that can intercept and modify data interactions for any software linked against it. The malicious injection is present only in the tarball download packages for versions 5.6.0 and 5.6.1, and not in the Git repository. The issue affects Fedora 41 and Fedora Rawhide but not Red Hat Enterprise Linux. The malicious code was demonstrated to interfere with OpenSSH daemon via systemd, which links to liblzma. The vulnerability has a CVSS 3.1 score of 10.0 (critical) with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
Potential Impact
This vulnerability allows execution of unauthorized code or commands by modifying the liblzma library used by software linked against it. It can intercept and alter data interactions, potentially compromising confidentiality, integrity, and availability of affected systems. The CVSS score of 10.0 reflects critical impact with full compromise possible remotely without authentication or user interaction. The malicious code presence in the widely used xz compression library source tarballs poses a significant supply chain risk. However, Red Hat Enterprise Linux versions are not affected, limiting exposure primarily to Fedora 41 and Rawhide users.
Mitigation Recommendations
Red Hat has stated that no versions of Red Hat Enterprise Linux are affected, and the malicious code is only present in the tarball downloads of xz versions 5.6.0 and 5.6.1, not in the Git repository. Users of Fedora 41 and Fedora Rawhide should avoid using the affected tarball versions and obtain xz from trusted sources or updated packages once available. Since no official patch or fix is currently referenced, users should monitor the vendor advisories from Red Hat and AWS for updates. There is no indication that the malicious code is present in official RHEL builds, so no action is required for RHEL users. Check vendor advisories for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2024-03-29T15:38:13.249Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2024-3094","vendor":"Red Hat"},{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2024-002/","vendor":"AWS"}]
Threat ID: 691ec3729f5a9374a9d10f9a
Added to database: 11/20/2025, 07:29:54 UTC
Last enriched: 08/04/2026, 13:15:38 UTC
Last updated: 08/05/2026, 00:41:05 UTC
Views: 159
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.