CVE-2024-3094: xz‑utils Backdoor Threatens OpenSSH via SystemD and IFUNC

CVE‑2024‑3094, known as the xz‑utils backdoor, exploits GNU IFUNC to inject malicious code into OpenSSH when Linux distributions link OpenSSH against SystemD, which in turn depends on xz‑utils. The attack chain relies on three design decisions: SystemD’s dependency on xz‑utils, the use of IFUNC for runtime symbol resolution, and the fact that many distros patch OpenSSH for SystemD without updating the underlying IFUNC logic. IFUNC allows arbitrary code to run before main, bypassing RELRO protections and enabling the attacker to modify the SSH server flowchart, potentially granting root access to the host. The vulnerability was discovered by security researcher Andres Freund and was a near‑miss; no widespread exploitation has been reported yet. The article argues that IFUNC should be considered an internal interface for glibc and avoided in other applications due to its complexity and fragility. It also highlights the lack of communication between the OpenSSH, SystemD, and xz‑utils teams, which allowed the flaw to persist in the supply chain. The recommended mitigation is to patch OpenSSH to a version that removes the SystemD dependency or to avoid using IFUNC in custom code. Finally, the piece calls for better coordination among open‑source projects to prevent similar supply‑chain attacks in the future.