Several Docker Images Contain Infamous XZ Backdoor Planted for More Than a Year

The cybersecurity community continues to grapple with the lingering effects of the XZ Utils backdoor, a sophisticated supply chain attack that shook the industry in March 2024.

What began as a carefully orchestrated two-year campaign by the pseudonymous developer ‘Jia Tan’ has evolved into a persistent threat that extends far beyond its initial discovery.

The malicious actor methodically built credibility within the XZ Utils project through numerous legitimate contributions before inserting a complex backdoor into the xz-utils packages, affecting major Linux distributions including Debian, Fedora, and OpenSUSE.

The backdoor operates through a sophisticated mechanism embedded within the liblzma.so library, which interfaces directly with OpenSSH servers.

When triggered by client interactions with infected SSH servers, the malicious code establishes three critical hooks targeting the RSA_public_decrypt, RSA_get0_key, and EVP_PKEY_set1_RSA functions.

This intricate attack chain begins with modified IFUNC resolvers for lzma_crc32 and lzma_crc64 functions, creating a pathway for backdoor functionality that remained undetected for months.

Recent investigations by Binarly researchers have revealed that the XZ Utils backdoor continues to pose significant risks to containerized environments more than a year after its initial discovery.

Their comprehensive analysis of Docker Hub repositories has uncovered over 35 infected images, with 12 Debian-based containers still publicly available and actively distributing the compromised code.

This discovery highlights a critical blind spot in container security, where historical artifacts containing known vulnerabilities persist in public repositories.

The research team’s findings extend beyond first-generation infected images. Through systematic scanning of Docker Hub’s extensive repository network, Binarly analysts identified numerous second-order containers built upon the compromised Debian base images.

These derivative containers, spanning various use cases from development environments to specialized applications, demonstrate how supply chain compromises can propagate through containerized ecosystems with minimal visibility.

Persistence and Propagation Mechanisms

The backdoor’s persistence within Docker environments reveals a fundamental challenge in container security lifecycle management. Unlike traditional software updates that can be systematically patched, container images often remain static historical artifacts once published.

The malicious code embedded in these containers maintains its functionality through the liblzma.so library’s integration with system processes, ensuring that any SSH server running within an infected container becomes a potential attack vector.

The technical implementation leverages IFUNC resolver modifications that redirect standard compression function calls through malicious handlers.

When the container initializes SSH services, the backdoor establishes its hooks within the sshd process context, creating persistent access channels that bypass traditional security monitoring.

This approach demonstrates the attacker’s deep understanding of both containerization technologies and system-level Linux operations, making detection particularly challenging for organizations relying solely on surface-level vulnerability scanning tools.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.