Here we have all the interesting information about the process as well as the link to its parent process. 'parent_exec_id': 'OjIwNjAyNjc1NDE0MTU2OjE1NDY0MA=', 'exec_id': 'OjIwNjAyOTk4NzY3ODU0OjE1NDY0Mg=', 'parent_exec_id': 'OjE0MTYwMDAwMDAwOjc0Mg=', 'exec_id': 'OjIwNjAyNjc1NDE0MTU2OjE1NDY0MA=', This vulnerability is related to the library liblzma.so used by the ssh daemon so let’s switch to the root user and install openssh-server along with other packages we will use later: To exploit this vulnerability, we’re going to use the GitHub resource here.

I’ve used an Ubuntu 22.04 virtual machine in Azure to setup the environment. We have learned that this vulnerability needs an x86 architecture to be exploited and that it targets several Linux distribution (source here). Follow along! Setup an environment for CVE 2024-3094 Let’s build an environment on which we can experiment and learn more about it.

I wrote another blog post on this topic with another example and another tool if you want to have a look. For this we have to apply a security strategy called Zero Trust. There are other vulnerabilities out there, so we need to be prepared for the unknown. I wondered how we could leverage Tetragon capabilities to detect it before it was known. I also did some research and experimented with this vulnerability. Detecting it with Tetragon from Isovalent (now part of Cisco) has been explained in this blog post. The recent discovery of the XZ Utils backdoor, classified as CVE 2024-3094, has been now well documented.

Ubuntu sudo exploit