Critical Red Hat Polkit Flaw (CVE-2021-3560) Lets Attackers Gain Root Privileges

Key Takeaways

• A sophisticated supply chain attack has injected malicious code into versions 5.6.0 and 5.6.1 of the xz compression utility.
• The vulnerability, tracked as CVE-2024-3094, allows attackers to bypass authentication and gain unauthorized remote access to affected Linux systems via SSH.
• Red Hat Enterprise Linux (RHEL) is unaffected, but Fedora Rawhide, Fedora Linux 40 beta, Debian unstable (Sid), and some openSUSE distributions are exposed.
• Immediate action, including downgrading xz to a safe version (5.4.x), is critical to mitigate the risk.

Critical Supply Chain Attack Discovered in XZ Compression Utility

Red Hat has issued an urgent security alert concerning a highly sophisticated supply chain compromise found within recent iterations of the widely used “xz” compression tools and libraries. This malicious code injection, identified as CVE-2024-3094, could enable threat actors to circumvent authentication mechanisms and achieve unauthorized remote access to vulnerable Linux systems.

The xz utility is a foundational component across nearly all commercial and community Linux distributions, primarily employed for compressing large files to facilitate efficient data transfer. Security researchers uncovered that malicious code was subtly embedded into versions 5.6.0 and 5.6.1 of this essential utility.

Stealthy Injection and Activation

Attackers employed advanced obfuscation techniques to conceal their activities. The malicious code is not directly visible within the primary Git repository. Instead, it is activated by a hidden M4 macro that is exclusively included in the full distribution download package. During the software build process, this concealed macro compiles secondary artifacts that subtly alter the library’s intended functionality.

Once deployed on a system, the compromised build directly interferes with the authentication processes of sshd through systemd. Secure Shell (SSH) is the industry-standard protocol for remote system administration. This interference grants malicious actors the ability to bypass authentication checks, thereby gaining complete and unauthorized remote access to the affected machine.

Affected Linux Distributions

Red Hat has confirmed that no versions of Red Hat Enterprise Linux (RHEL) are impacted by this vulnerability. Within the Red Hat ecosystem, the compromised packages are limited to Fedora Rawhide and the Fedora Linux 40 beta.

Users of Fedora Rawhide might have installed either version 5.6.0 or 5.6.1. Similarly, Fedora 40 beta environments were exposed to version 5.6.0 through recent update cycles. While Red Hat notes that the malicious code injection does not appear to have successfully executed in Fedora 40 builds, the mere presence of these compromised libraries still poses a significant security risk.

Beyond Red Hat, other community distributions are also confronting this threat. Evidence indicates that the injected code successfully built in Debian unstable (Sid) and several openSUSE distributions, necessitating broad vigilance across the Linux ecosystem.

What You Should Do

• Immediate Downgrade: System administrators must urgently audit their infrastructure for xz versions 5.6.0 and 5.6.1 and replace them without delay. The recommended safe version is 5.4.x.
• Fedora Rawhide Users: Red Hat strongly advises users to completely halt all usage of Fedora Rawhide instances for both work and personal activities until the system is fully reverted to the safe xz-5.4.x version.
• Fedora Linux 40 Beta Users: An emergency update has been released to force a downgrade to the 5.4.x build. Apply this update immediately.
• OpenSUSE and Debian Users: Consult your specific distribution maintainers for immediate downgrade procedures and updated packages.
• Audit and Monitor: Actively audit your network infrastructure for any systems running the compromised xz versions and implement continuous monitoring for suspicious activity related to SSH authentication.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.