Lucene search

K

ROSA LABROSA-SA-2024-2408

HistoryApr 23, 2024 - 12:20 p.m.

Advisory ROSA-SA-2024-2408

2024-04-2312:20:30

ROSA LAB

abf.rosalinux.ru

41

xz

rosa virtualization

malicious code

library interception

security vulnerability

unix

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.144

Percentile

95.8%

Software: xz 5.2.4
OS: ROSA Virtualization 2.1

package_evr_string: xz-5.2.4-1

CVE-ID: CVE-2024-3094
BDU-ID: 2024-02406
CVE-Crit: CRITICAL.
CVE-DESC.: Malicious code was discovered in xz source archives starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a pre-created object file from a disguised test file that exists in the source code, which is then used to modify certain functions in the liblzma code. The result is a modified liblzma library that can be used by any software associated with that library that intercepts and modifies data interactions with that library.
CVE-STATUS: Not relevant
CVE-REV:

OSVersionArchitecturePackageVersionFilename
ROSAanynoarchxz< 5.2.4UNKNOWN

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.144

Percentile

95.8%