Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Pictures, Fueling Provide Chain Dangers

Aug 12, 2025Ravie LakshmananMalware / Container Safety

New analysis has uncovered Docker photographs on Docker Hub that comprise the notorious XZ Utils backdoor, greater than a 12 months after the invention of the incident.

Extra troubling is the truth that different photographs have been constructed on prime of those contaminated base photographs, successfully propagating the an infection additional in a transitive method, Binarly REsearch mentioned in a report shared with The Hacker Information.

The firmware safety firm mentioned it found a complete of 35 photographs that ship with the backdoor. The incident as soon as once more highlights the dangers confronted by the software program provide chain.

The XZ Utils provide chain occasion (CVE-2024-3094, CVSS rating: 10.0) got here to gentle in late March 2024, when Andres Freund sounded the alarm on a backdoor embedded inside XZ Utils variations 5.6.0 and 5.6.1.

Additional evaluation of the malicious code and the broader compromise led to a number of startling discoveries, the at the beginning being that the backdoor might result in unauthorized distant entry and allow the execution of arbitrary payloads by SSH.

Particularly, the backdoor — positioned within the liblzma.so library and utilized by the OpenSSH server — was designed such that it triggered when a consumer interacts with the contaminated SSH server.

By hijacking the RSA_public_decrypt perform utilizing the glibc’s IFUNC mechanism, the malicious code allowed an attacker possessing a particular non-public key to bypass authentication and execute root instructions remotely,” Binarly defined.

The second discovering was that the modifications have been pushed by a developer named “Jia Tan” (JiaT75), who spent nearly two years contributing to the open-source mission to construct belief till they got maintainer duties, signaling the meticulous nature of the assault.

“That is clearly a really advanced state-sponsored operation with spectacular sophistication and multi-year planning,” Binary famous on the time. “Such a fancy and professionally designed complete implantation framework shouldn’t be developed for a one-shot operation.”

The most recent analysis from the corporate exhibits that the impression of the incident continues to ship aftershocks by the open-source ecosystem even in any case these months.

This consists of the invention of 12 Debian Docker photographs that comprise one of many XZ Utils backdoor, and one other set of second-order photographs that embrace the compromised Debian photographs.

Binarly mentioned it reported the bottom photographs to the Debian maintainers, who mentioned they’ve “made an intentional selection to go away these artifacts obtainable as a historic curiosity, particularly given the next extraordinarily unlikely (in containers/container picture use instances) elements required for exploitation.”

Nonetheless, the corporate identified that leaving publicly obtainable Docker photographs that comprise a possible network-reachable backdoor carries a major safety danger, regardless of the factors required for profitable exploitation – the necessity for community entry to the contaminated gadget with the SSH service working.

“The xz-utils backdoor incident demonstrates that even short-lived malicious code can stay unnoticed in official container photographs for a very long time, and that may propagate within the Docker ecosystem,” it added.

“The delay underscores how these artifacts might silently persist and propagate by CI pipelines and container ecosystems, reinforcing the vital want for steady binary-level monitoring past easy model monitoring.”