XZ Utils - A Two-Year Campaign to Become the Maintainer → Backdoor Shipped Only in Release Tarballs → IFUNC Hook Into sshd → Pre-Auth RCE for One Ed448 Key
CVE-2024-3094, CVSS 10.0. Beginning in 2021, an identity using the name "Jia Tan" spent roughly two years building a contribution history in XZ Utils, a compression library present on essentially every Linux system. Suspected sock puppet accounts - names including "Jigar Kumar", "krygorin4545" and "misoeater91" - pressured the exhausted original maintainer, Lasse Collin, to hand over responsibility. In January 2023 Jia Tan had maintainer privileges. In February 2024 versions 5.6.0 and 5.6.1 shipped a backdoor that was not in the git repository: it was injected through a modified build-to-host.m4 present only in the release tarballs, and only activated on x86-64 Linux builds using glibc and GCC packaged via dpkg or rpm. Through the systemd-to-liblzma linkage it hooked RSA_public_decrypt in sshd, giving pre-authentication remote code execution to whoever held a specific Ed448 private key. It was caught by accident. Andres Freund, a Microsoft engineer investigating a performance regression, noticed sshd logins taking about half a second longer than they should.
Every other supply-chain chain on this page starts with theft or exploitation - a stolen token, a phished maintainer, a poisoned build step. This one starts with work. The account was created in August 2021; the contributions that followed were real, useful, and reviewed, and they continued for about two years before anything malicious appeared. That patience is the entire innovation. There is no exploit to detect and no anomaly to alert on, because for two years the attacker was doing exactly what a valuable open-source contributor does, and the community's response - trust, gratitude, increasing responsibility - was the correct response to what it could observe.
Early 2022: Joins the XZ mailing list, begins contributing minor patches
Duration: Roughly two years of legitimate, useful, reviewed contributions
Detectable anomaly during this phase: None
Why it works: The community's trust was a correct inference from everything visible
The pressure campaign is the part worth reading in the original mailing-list archives, because it is genuinely difficult to look at. Multiple accounts, now believed to be sock puppets, complained about the pace of XZ releases and pushed for a new maintainer - while Collin, who maintained the project as an unpaid volunteer, had publicly mentioned mental health difficulties and limited time. The campaign exploited that directly. By January 2023 Jia Tan held maintainer privileges, and in March 2023 made the first release. This attack targeted the sustainability crisis in open source as precisely as any technical vulnerability: the exploit was one exhausted person maintaining critical infrastructure alone for free, which describes a large fraction of the dependency tree every organization on this page relies on.
Method: Public complaints about release pace, pressure for a new maintainer
Target: An unpaid volunteer who had spoken publicly about limited time and mental health
January 2023: Jia Tan obtains maintainer privileges
March 2023: Jia Tan makes their first release, 5.4.2
crc64_fast.c went in - infrastructure the backdoor would later depend on, committed openly and reviewed as ordinary optimization workAround June 2023 a series of changes added indirect function (IFUNC) support to the CRC code. IFUNC is a legitimate glibc mechanism that lets a program select an optimized implementation at load time based on CPU features, and in a compression library that is exactly the kind of performance work you would expect and welcome. It also provides a hook point that runs during dynamic linking, before main, which is what the backdoor would later use. Splitting the attack this way means no single commit ever looks wrong: the enabling infrastructure arrives months early with a genuine justification, and the payload arrives later as data rather than as reviewable source. Code review catches malicious code; it does not catch a legitimate capability being added early by someone who intends to use it later.
crc64_fast.cWhat IFUNC is: A glibc mechanism selecting an optimized implementation at load time
Why it is plausible: Exactly the performance work a compression library should do
What it provides: A hook point executing during dynamic linking, before
mainWhy review missed it: No individual commit is malicious; the capability is genuine
build-to-host.m4 that existed only in the release tarballs, not in the git repository, and extracted the payload from test files during the buildThis is the detail that defeats how nearly everyone verifies open-source software. Auditing the git repository would have found nothing, because the malicious build-to-host.m4 was present only in the tarballs Jia Tan released separately. The payload itself lived in files that looked like binary compression test fixtures - exactly the kind of unreadable blob a compression project legitimately contains by the hundred - and the modified build script extracted and assembled it during compilation. The injection was also conditional, running only when building on x86-64 Linux with glibc and GCC under dpkg or rpm, which narrowed it to the distribution packages that mattered while keeping it invisible almost everywhere else, including in most casual build-from-source testing.
Injection point: A modified
build-to-host.m4, present only in release tarballsPayload location: Files resembling binary compression test fixtures
Conditions: x86-64 Linux, glibc, GCC, built via dpkg or rpm
Why audits missed it: The git repository was clean; the tarball was not
RSA_public_decrypt in sshd, giving pre-authentication remote code execution to a client holding a specific Ed448 private keyOpenSSH does not depend on liblzma. It got there transitively: several distributions patch sshd to integrate with systemd notification, systemd links against liblzma, and so a compression library ends up inside the address space of the most security-critical daemon on the machine. The backdoor used its IFUNC hook to intercept RSA_public_decrypt during authentication, so a client presenting a certificate signed with the attacker's Ed448 key could have commands executed before authentication completed. Two properties are worth noting. The backdoor was authenticated - only the key holder could use it, so it was not a vulnerability others could stumble into and it left no obvious open door. And the reachability came from a dependency relationship nobody had deliberately created, which is the general hazard: your attack surface includes what your dependencies' dependencies are linked into.
Hook: IFUNC resolver intercepting
RSA_public_decrypt during authenticationCapability: Pre-authentication remote code execution as root
Access control: Restricted to the holder of a specific Ed448 private key
General lesson: Your attack surface includes what your transitive dependencies are linked into
There is no defensive lesson in the discovery, and pretending otherwise would be dishonest. A Microsoft engineer and PostgreSQL developer was doing unrelated performance work, noticed that SSH logins on a testing distribution felt slightly slow, and was curious enough to profile rather than shrug. That led to liblzma consuming CPU it had no business consuming, and from there to the backdoor, which he disclosed on the oss-security mailing list on March 29, 2024. Because the malicious versions had reached mainly testing and rolling distributions - Debian sid, Fedora Rawhide and 40 beta, openSUSE Tumbleweed, Kali - the blast radius on stable production systems was small. Had it survived a few more months into stable releases of major distributions, it would have been present on a very large share of the internet's Linux servers, with pre-auth root access available to one party.
Signal: ~500ms extra sshd latency and unexplained CPU usage
Method: Profiling sshd during unrelated performance work
Disclosed: March 29, 2024 on the oss-security mailing list
Reached: Mainly testing and rolling distros - Debian sid, Fedora Rawhide/40 beta, openSUSE Tumbleweed, Kali
Counterfactual: A few more months and it would have been in stable releases worldwide