The XZ-Utils backdoor, which researchers first discovered in March 2024, remains present in at least 35 Linux images on Docker Hub. This situation potentially puts users, organizations, and their data at risk.
Docker Hub serves as the official public container image registry operated by Docker. It allows developers and organizations to upload or download prebuilt images while sharing them with the community.
Many CI/CD pipelines, developers, and production systems pull images directly from Docker Hub as base layers for their own containers. If those images become compromised, the new build inherits the flaw or malicious code.
Binarly researchers have identified numerous Docker images that still suffer from the XZ-Utils backdoor.
“At first glance, this might not seem alarming: if the distribution packages were backdoored, then any Docker images based on them would be infected as well,” reports Binarly.
“However, what we discovered is that some of these compromised images are still publicly available on Docker Hub. And even more troubling, other images have been built on top of these infected base images, making them transitively infected.”
Binarly reported the images to Debian, one of the maintainers still offering backdoored images. However, Debian decided not to take them offline, citing low risk and the importance of archiving continuity.
The XZ-Utils backdoor, tracked under CVE-2024-3094, contained malicious code hidden in the liblzma.so library of the xz-utils compression tool, specifically in versions 5.6.0 and 5.6.1.
It hooked the RSA_public_decrypt function in OpenSSH via glibc’s IFUNC mechanism. Consequently, if an attacker with a special private key connected over SSH to an affected system, they could bypass authentication and remotely run commands as root.
The backdoor stealthily injected by a long-time project contributor named “Jia Tan” shipped in official Linux distro packages like Debian, Fedora, OpenSUSE, and Red Hat. This situation made it one of the most severe software supply chain compromises last year.
Fortunately, the backdoor was discovered early on, which gave attackers very little opportunity to leverage it. Additionally, scanners released by Binarly and Kaspersky, among others, helped detect it on dependent open-source software.
Debian’s response
To the researchers’ surprise, Debian did not retract 64-bit images that use the backdoored version of the library from Docker Hub. They found at least 35 of these images still available for download.
Binarly comments that this figure only partially reflects the real scale of the problem, as they did not perform a platform-wide scan for the XZ-Utils backdoor.
“We identified more than 35 images that ship with the backdoor,” explains Binarly in its report.
“While this may seem like a small number, we only scanned a small portion of the images published on DockerHub, stopping at second-order images.”
Debian states they intentionally opted not to remove these images from Docker Hub, choosing instead to leave them as historical artifacts. They advise users to only use up-to-date images and avoid old ones.
The maintainers made this decision because they believe the requirements for exploitation are unlikely. For instance, they noted that exploitation would require sshd installed and running on the container, the attacker having network access to the SSH service on that container, and using a private key that matches the backdoor’s trigger logic.
Debian maintainer’s response
Source: Binarly
Binarly expresses disagreement with this approach, underlining that merely making these images accessible to the public poses a significant risk from accidental pulls or use in automated builds.
The same concern applies to all images that may contain a compromised version of the XZ-Utils backdoor. Therefore, users should manually check and ensure the library is on version 5.6.2 or later, with the latest stable version being 5.8.1.
Source: BleepingComputer, Bill Toulas
Read more at Impreza News
