Back to threat feeds
Malware
35 Docker Hub Images Still Carry the Deadly XZ Backdoor After 1 Year
Over a year later, 35 Docker Hub images still hide the critical XZ backdoor, risking silent SSH takeovers for unsuspecting developers.
Continue reading
Over a year later, 35 Docker Hub images still hide the critical XZ backdoor, risking silent SSH takeovers for unsuspecting developers.
Continue reading
A highly sophisticated backdoor (CVE‑2024‑3094) was discovered in the Linux XZ‑Utils compression library—specifically in the `liblzma.so` component of versions 5.6.0 and 5.6.1. The compromised code was carefully introduced by a contributor known as “Jia Tan,” exploiting the glibc IFUNC mechanism to hijack OpenSSH's `RSA_public_decrypt` function. If triggered—via having the right Ed448 private key—this flaw could grant remote root access over SSH to affected systems.
Debian, Fedora, OpenSUSE, Red Hat, and others shipped packages containing this backdoor, though thankfully—due to its early detection—it largely avoided widespread deployment into production systems.
Andres Freund—a developer at Microsoft and contributor to PostgreSQL—first noticed anomalous SSH behavior on Debian Sid. SSH sessions were triggering unusually high CPU consumption and Valgrind errors, prompting deeper investigation. Freund traced the issue back to `liblzma`, revealing the malicious injection. He promptly reported the issue to the oss‑security mailing list on March 29, 2024.
Over roughly two years, a contributor using multiple pseudonyms—including “Jia Tan” and “JiaT75”—slowly gained trust in the XZ‑Utils project. Once granted maintainer privileges, this actor published version 5.6.0 containing the backdoor, followed by 5.6.1, which attempted to conceal test anomalies. The malicious payload resided in specially crafted test files and a manipulated `build-to-host.m4` script, packaged with release tarballs but not present in the source repository, ensuring stealth during builds for x86-64 via dpkg or RPM. Security experts have noted the operation’s sophistication and speculate a possible state‑sponsored effort given its duration, obfuscation tactics, and high operational security, citing parallels to APT29/Cosy Bear.
Fast forward to August 2025, and the backdoor problem has resurfaced in a new form: Docker Hub images. Binarly researchers uncovered at least 35 publicly accessible Docker images—including Debian base images—that still embed the compromised XZ‑Utils libraries. Even more concerning, derivative images built on these bases are transitively infected.
A recent issue raised on GitHub further confirmed this: 10 official Debian base image tags were identified as still containing the backdoor, urging their removal.
Rather than removing these compromised images, Debian claimed they serve as historical artefacts and advised users to avoid using outdated image tags. Binary criticised this decision, noting that such photos could be unknowingly pulled or used in CI/CD pipelines, continuing the risk.
This incident highlights vulnerabilities that arise when open-source maintenance ecosystems trust contributors implicitly. The backdoor’s insertion relied on a long game: gaining commit and release rights, then hiding malicious code in build artefacts. This strategy eluded typical code review and repository audit mechanisms.
Docker’s popularity and convenience—especially using base images from trusted sources—can inadvertently propagate deep‑rooted supply chain threats. Once an infected base is published, every descendant container becomes compromised, often without scrutiny.
Security agencies like CISA swiftly recommended downgrading to safe XZ‑Utils versions. Red Hat, SUSE, Debian, and others reverted to pre‑backdoor builds. Canonical delayed Ubuntu 24.04 LTS beta to conduct a full binary rebuild, ensuring no compromised packages slipped through.
Scanners from Binarly, Kaspersky, and others were made available to help detect the backdoor in systems and container images.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
