CVE-2024-3094Vulnerability
Reported by 3 independent sources · first reported by Elastic Security Labs · last reported
Last reported 2 months ago
What the reports say
4 reports, newest first · the exact sentence from each-
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain“…spending years pretending to be helpful contributors just to hide backdoors in core software, as seen in the XZ Utils vulnerability (CVE-2024-3094).”
-
Leveraging Landlock Telemetry for Linux Detection Engineering“XZ Utils is unfortunately a well-known case because of the CVE-2024-3094, when malicious code was discovered in some tarballs versions (5.6.0 and 5.6.1).”
-
Automating GOAD and Live Malware Labs“Linux host infected with CVE-2024-3094 for supply chain simulation.”
-
500ms to midnight: XZ A.K.A. liblzma backdoor“CVE-2024-3094 explains how the changes in the liblzma were created from the malicious additions to the library’s build scripts and directly impacts any software that links the library on an impacted system.”
Indicators reported together
named in the same reports- 142.250.179[.]110in 1 report
- hxxps://docs.kernel[.]org/admin-guide/LSM/landlock.htmlin 1 report
- process[.]pidin 1 report
- process.parent[.]pidin 1 report
- hxxps://github[.]com/elastic/detection-rulesin 1 report
- f1982d1db5aacd2d…ff66ec0f93abin 1 report
- 5448850cdc3a7ae4…0d2685db3049in 1 report
- hxxps://gist.github[.]com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#file-hashes-txt-L115in 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2021-34527
Thanks — we review every report.