← Incident Index
CivilizationalOpen Source Infrastructure·March 29, 2024Draft

xz utils (Tukaani Project): CVE-2024-3094 — multi-year social-engineering attack inserts backdoor into xz/liblzma

A threat actor operating under the pseudonym "Jia Tan" gained maintainer access to the xz utils project over a 2-year campaign and inserted a backdoor into liblzma that targeted OpenSSH on systemd-linked Linux distributions. Caught accidentally by a Microsoft engineer noticing 500ms latency in SSH connections.

Velocity Governance perspective· Sentinel-10 overlap: 1 of 4

1 of the 4 practices that failed in this incident is part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.

This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →

Impact

CISA emergency advisory; triggered global supply-chain review across Linux distributions
Regulatory action

Backdoor would have provided remote code execution to virtually every internet-facing Linux server had it shipped to stable releases. Caught before broad distribution by chance — worst-case prevented narrowly.

Root cause (from published RCA)

The xz utils project had a single overworked maintainer. A second contributor ("Jia Tan") spent ~2 years building trust through legitimate contributions, was granted commit access, and used that access to introduce build-system modifications that selectively injected malicious code into liblzma during the build process. The malicious payload was hidden in test fixtures and only activated by specific build configurations.

Concordance protocols that map to this root cause

Click any protocol to see every other indexed incident where it failed.

Protocol 3.6Code Ownership· DevelopmentSENTINELsee all incidents →
Code ownership: a critical infrastructure library had a single maintainer with no co-ownership or succession structure.
Protocol 3.5Approval Rigor· Developmentsee all incidents →
Approval rigor on build-system changes was insufficient — modifications to m4 macros and test fixtures merged without independent review.
Protocol 4.7Dependency Scanning· Testingsee all incidents →
Dependency scanning did not detect the build-time payload; static analysis tools did not run on test fixtures.
Protocol 4.8Build Reproducibility· Testingsee all incidents →
Build reproducibility: the malicious payload required specific build configurations to activate, exploiting the gap between source code and shipped binary.

Primary sources

XZ Backdoor — Tukaani Project Statement
Tukaani Project · April 1, 2024
oss-security: backdoor in upstream xz/liblzma leading to ssh server compromise
Andres Freund / openwall · March 29, 2024
CVE-2024-3094
NIST NVD · March 29, 2024
CISA Alert: Reported Supply Chain Compromise Affecting XZ Utils
CISA · March 29, 2024

Related incidents

Other incidents that failed at least one of the same protocols.

OktaOct 2023
Okta support-portal HAR file leak exposes 134 customer environments
SolarWindsDec 2020
SUNBURST malware injected into Orion build pipeline compromises 18,000…
Progress Software (MOVEit)May 2023
CVE-2023-34362 SQL injection in MOVEit Transfer leads to mass data the…
CodecovApr 2021
Codecov bash-uploader supply-chain compromise exfiltrates customer sec…
#supply-chain#social-engineering#maintainer-burnout#open-source#build-integrity
Check your repo against these protocols.
Concordance scores any public GitHub repo against all 50 engineering protocols in 60 seconds. No signup, no install.
Run a free scan →
Concordance Incident Index entry · CC BY 4.0 · Methodology · Errata: hello@concordancelabs.com