xz-utils Backdoor Found in Kali Linux Installations – Check for Malware Infection

A backdoor was recently discovered in the xz-utils package versions 5.6.0 to 5.6.1, shocking the Linux community. This poses a significant threat to the security of Linux distributions, including Kali Linux.

The vulnerability, CVE-2024-3094, could potentially allow malicious actors to compromise sshd authentication, granting unauthorized access to systems remotely.

The xz-utils package is a widely used library in the Linux ecosystem for data compression, making the severity of this vulnerability particularly alarming.

The backdoor was discovered in versions 5.6.0 and 5.6.1 of the xz-utils package, and had it not been identified and addressed promptly, it could have had far-reaching consequences.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Run Free Threat Scan

The issue was quickly patched in Debian and, consequently, in Kali Linux, mitigating the potential impact.

Kali Installation Affected

Kali Linux users who updated their installations between March 26th and March 29th, 2024, are at risk of having installed the compromised version of xz-utils (5.6.0-0.2).

It is crucial for users who updated their systems during this period to apply the latest updates immediately to rectify the issue.

However, according to a statement from Kali Linux, this vulnerability does not affect those who did not update their Kali installations before March 26th.

To check if your system is affected, you can execute the following command:

apt-cache policy liblzma5

If the output indicates that version 5.6.0-0.2 is installed, it is imperative to upgrade to the latest version (5.6.1+really5.4.5-1) using the following commands:

sudo apt update && sudo apt install -y --only-upgrade liblzma5

This incident is a reminder to act promptly on security vulnerabilities.

The quick identification and resolution of the backdoor in xz-utils highlight the responsiveness of the Linux community to security threats.

Users are encouraged to stay informed about potential vulnerabilities and to apply updates and patches as soon as they become available to ensure the security of their systems.

For more detailed information on the vulnerability and guidance on addressing it, users can refer to the initial disclosure on Openwall, the summary post on Help Net Security, and the National Vulnerability Database (NVD) entry for CVE-2024-3094.

The discovery of the xz-utils backdoor underscores the ongoing challenges in securing the software supply chain and the critical role that community vigilance and rapid response play in safeguarding the integrity of open-source software.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide