id: CVE-2024-3094

info:
  name: XZ - Embedded Malicious Code
  author: pdteam
  severity: critical
  description: |
    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
  reference:
    - https://www.openwall.com/lists/oss-security/2024/03/29/4
    - https://access.redhat.com/security/cve/CVE-2024-3094
    - https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
    - https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
    - https://bugzilla.redhat.com/show_bug.cgi?id=2272210
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
    epss-score: 0.00045
    epss-percentile: 0.13335
  tags: cve,cve2024,local,code,xz,backdoor

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      # find path to liblzma used by sshd
      path="$(ldd $(which sshd) | grep liblzma | grep -o '/[^ ]*')"

      # does it even exist?
      if [ "$path" == "" ]
      then
        echo probably not vulnerable
        exit
      fi

      # check for function signature
      if hexdump -ve '1/1 "%.2x"' "$path" | grep -q f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410
      then
        echo probably vulnerable
      else
        echo probably not vulnerable
      fi

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 4a0a00473045022100a77874a0147b7bec600048162bb36b1e05ebeef8632466a877c537337be8ad5702201e1b8f9b3755abec0150d9d93a8a5d46c7a381deafbb97d594262c768d10f3f8:c40a3a04977cdbf9dca31c1002ea8279