Companies/Linode (Akamai)/Incidents

Linode (Akamai): Open-source library XZ Utils Vulnerability (CVE-2024-3094)

Timeline of updates

1. resolved2024-04-01 21:37 UTC

   Akamai is aware of the reported supply chain compromise in the XZ Utils data compression library (CVE-2024-3094) which affects versions 5.6.0 and 5.6.1 of the xz-utils package. This vulnerability attempts to introduce the ability for an attacker to remotely execute commands in OpenSSH through the use of the liblzma library within some operating system environments. Akamai has assessed the vulnerability, and determined that the Akamai Platform is not affected and the Linux images currently offered by Linode are also not affected . However, customers who installed Kali Linux linodes between March 26 and March 29, or who switched to or upgraded their linodes to e.g., “unstable” or “testing” streams of certain Linux versions on their own may be affected. We strongly recommend that those customers follow the guidance of the OS provider to either patch or downgrade the affected packages as needed. To determine whether your system might be affected: Check the version of xz-utils and liblzma: xz --version In the output, make sure that the versions displayed are not 5.6.0 or 5.6.1. Verify that /usr/sbin/sshd is not linked against liblzma: ldd /usr/sbin/sshd | grep liblzma If the output of this command is empty, then the system is not affected. If the output contains the pathname of the liblzma library, then the system may be affected depending on the version of liblzma/xz-utils as noted above. In addition, customers of Akamai Guardicore can utilize Akamai Guardicore Segmentation Insight to identify affected systems – see our detailed blog post for more details. For more information about this vulnerability, please see: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 (opens in new tab) https://www.openwall.com/lists/oss-security/2024/03/29/4 (opens in new tab) https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users (opens in new tab) https://lists.debian.org/debian-security-announce/2024/msg00057.html (opens in new tab) https://news.opensuse.org/2024/03/29/xz-backdoor/ (opens in new tab) https://www.kali.org/blog/about-the-xz-backdoor/ (opens in new tab) Thank you for your continued support.

From Linode (Akamai)’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.

Impact, status and times are the vendor’s own, as last archived. View on status.linode.com (opens in new tab).

Linode (Akamai) profileRecent Linode (Akamai) incidentsAll outages on April 1, 2024Linode (Akamai) in April 2024MarkdownJSON