CVE-2024-3094: Active Exploitation of XZ Utils 'Copy Fail' Backdoor — Detection and Remediation

---
title: Potential XZ Utils Backdoor Vulnerable Version Detected
id: 1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890
status: experimental
description: Detects systems running the backdoored versions of XZ Utils (5.6.0 or 5.6.1) based on command line checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-3094
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2024/04/02
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:\    Image|endswith: '/xz'
    CommandLine|contains:
      - '--version'
    CommandLine|contains|all:
      - '5.6.0'
      - '5.6.1'
  condition: selection
falsepositives:
  - Legitimate testing of xz utilities (rare in production)
level: critical
---
title: XZ Utils Malicious Test File Creation Access
id: 2b3c4d5e-6f78-901a-2b3c-4d5e6f789012
status: experimental
description: Detects file access events associated with the known malicious test files injected in XZ Utils 5.6.0/5.6.1 build process.
references:
  - https://github.com/tukaani-project/xz/releases
author: Security Arsenal
date: 2024/04/02
tags:
  - attack.resource_development
  - attack.t1608
logsource:
  product: linux
  category: file_access
detection:
  selection:\    TargetFilename|contains:
      - '/tests/files/bad-3-corrupt_lzma2.xz'
      - '/tests/files/good-large_compressed.lzma'
  condition: selection
falsepositives:
  - Developer machines building the xz package from source
level: high

// Hunt for execution of vulnerable XZ Utils versions
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has \"xz\"
| where ProcessCommandLine has \"--version\"
| where ProcessCommandLine has_any (\"5.6.0\", \"5.6.1\")
| project DeviceName, Timestamp, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

-- Hunt for XZ Utils Backdoor Indicators
SELECT
  FullPath,
  Size,
  ModTime,
  Mode
FROM glob(globs='/**/liblzma.so.5.6.0')
WHERE ModTime > '2024-02-01'

UNION ALL

SELECT
  FullPath,
  Size,
  ModTime,
  Mode
FROM glob(globs='/**/tests/files/bad-3-corrupt_lzma2.xz')

#!/bin/bash

# CVE-2024-3094 Remediation Script
# Checks for vulnerable XZ Utils versions and attempts to update

LOG_FILE=\"/var/log/xz_remediation.log\"
echo \"Starting XZ Utils remediation check: $(date)\" | tee -a \"$LOG_FILE\"

# Function to check xz version
check_version() {
    if command -v xz &> /dev/null; then
        VERSION=$(xz --version | head -n 1 | grep -oP 'xz \\K[0-9.]+')
        echo \"Detected XZ Version: $VERSION\" | tee -a \"$LOG_FILE\"
        if [[ \"$VERSION\" == \"5.6.0\" ]] || [[ \"$VERSION\" == \"5.6.1\" ]]; then
            echo \"[ALERT] Vulnerable version $VERSION found.\" | tee -a \"$LOG_FILE\"
            return 1
        else
            echo \"[OK] Version $VERSION is not vulnerable.\" | tee -a \"$LOG_FILE\"
            return 0
        fi
    else
        echo \"[INFO] xz is not installed.\" | tee -a \"$LOG_FILE\"
        return 0
    fi
}

# Check for vulnerable library existence
check_libs() {
    echo \"Checking for vulnerable liblzma libraries...\" | tee -a \"$LOG_FILE\"
    if find /usr -name \"liblzma.so.5.6.0\" -o -name \"liblzma.so.5.6.1\" 2>/dev/null | grep -q .; then
        echo \"[ALERT] Vulnerable library file found.\" | tee -a \"$LOG_FILE\"
        return 1
    fi
    return 0
}

# Main execution
if check_version || check_libs; then
    echo \"No immediate action required based on version check.\" | tee -a \"$LOG_FILE\"
else
    echo \"Attempting remediation...\" | tee -a \"$LOG_FILE\"
    # Determine package manager
    if command -v apt-get &> /dev/null; then
        apt-get update
        # Force install stable version or downgrade
        apt-get install --only-upgrade -y xz-utils
    elif command -v yum &> /dev/null; then
        yum update -y xz
    elif command -v dnf &> /dev/null; then
        dnf upgrade -y xz
    elif command -v apk &> /dev/null; then
        apk add xz
    else
        echo \"[ERROR] No known package manager found. Please manually update XZ Utils to version 5.4.6 or later stable.\" | tee -a \"$LOG_FILE\"
        exit 1
    fi
    
    echo \"Remediation attempt complete. Re-run check to verify.\" | tee -a \"$LOG_FILE\"
fi

echo \"Remediation script finished: $(date)\" | tee -a \"$LOG_FILE\"