Skip to main content

SUP-COMPROMISE-005 Compromised build pipeline

A direct or transitive dependency matches a catalogued compromised_build incident: the upstream release tarball, distro packaging step or CI artefact was poisoned while the public source looked clean. Auditing the source repository alone misses it, and the attacker may have spent years earning trust before activating the payload.

What Vulkro detects​

Every (ecosystem, name, version) found by the dependency scan is looked up in the curated compromised-release catalog. A row of kind compromised_build whose versions[] contains the installed version produces this finding.

Severity comes from the catalog row (typically Critical). Confidence High. Evidence signal: compromised-release-exact-version-match, weight 1.0.

Catalogued incidents:

  • INCIDENT-2024-xz (system xz@5.6.0, 5.6.1): a multi-year operation that added an sshd backdoor to xz release tarballs (CVE-2024-3094).
  • INCIDENT-2024-xz-utils (system xz-utils@5.6.0, 5.6.1): the same tarballs shipped by Debian, Ubuntu and Fedora packaging.

The xz rows are in the system ecosystem (distro packages). Matching uses ecosystem, name and version together, so an npm package with the same name does not collide.

Non-compliant code​

Either install hits INCIDENT-2024-xz or INCIDENT-2024-xz-utils.

$ dpkg -l xz-utils
ii  xz-utils       5.6.0-1
$ rpm -q xz
xz-5.6.1-1.fc40

Compliant code​

A release built before the compromise. The advisory in the finding cites the affected versions and the distro notice.

$ apt install xz-utils=5.4.6-0+deb12u1

How to fix​

  • Downgrade to a release built before the compromise, following the distro's security advisory for packaged versions.
  • Verify binaries built from the affected sources against vendor-published hashes (for xz, liblzma.so and anything linked against it).
  • Treat hosts that ran it as compromised for that window. The xz backdoor targeted sshd: rotate SSH host keys, audit access logs, and rebuild from a clean image where feasible.
  • Run vulkro respond to find the same version in your other projects.

References​

See also: vulkro scan, SUP-COMPROMISE-004, MAL-BINARY.

Last updated on