Andres Freund and the XZ Utils Backdoor Discovery Explained

Andres Freund is a Microsoft software engineer and PostgreSQL developer who became widely known in 2024 after uncovering the XZ Utils backdoor, tracked as CVE-2024-3094. He identified the issue while investigating a performance regression in sshd, including unusual CPU usage and a valgrind complaint, which led to the discovery of malicious code in liblzma that could enable remote code execution and administrator access through OpenSSH.

The significance of his discovery was not only technical. The backdoor had been inserted into a widely used open-source component, targeted Linux distribution pipelines, and was close to reaching more production systems through Debian testing, Debian unstable, and downstream packaging.

Who he is

Freund is known in two overlapping communities: database infrastructure and low-level systems software. He is a PostgreSQL developer and a Microsoft engineer, with work that places him close to the kind of performance analysis, micro-benchmarking, and systems debugging that made the XZ incident visible in the first place.

That background matters because the XZ backdoor was not discovered through a routine antivirus alert or a public exploit report. It emerged from careful observation of unexpected behavior in normal testing, specifically while benchmarking postgres-related changes and examining why SSH authentication activity looked wrong.

Why he became notable

Freund became a central figure in cybersecurity news on 29 March 2024, when he disclosed that upstream XZ Utils and liblzma contained a backdoor affecting versions 5.6.0 and 5.6.1. His warning was especially urgent for users on Debian testing, Debian unstable, and other bleeding-edge environments that had pulled in the affected packages.

The issue was severe because the malicious patch path could interfere with OpenSSH in certain builds, especially where sshd interacted with systemd-related packaging and linked compression components in the compromised build chain. The assigned CVE was CVE-2024-3094, and the vulnerability received a CVSS score of 10.0.

How the XZ backdoor worked

The compromise targeted the build and release process rather than only the visible source tree. Malicious code was hidden in compressed test files and build scripts, then activated during the build process to alter liblzma in a way that created a backdoor path into SSH authentication handling.

In practical terms, the exploit chain aimed to let an attacker gain remote code execution and administrator access on affected systems running vulnerable package builds. The backdoor also relied on a specific Ed448 private key, showing that the implant was not a random breakage but a carefully designed access mechanism.

Key technical elements

• Affected software: XZ Utils and liblzma

• Affected versions: 5.6.0 and 5.6.1

• Primary target path: sshd via OpenSSH under specific build conditions

• Discovery signals: performance regression, elevated CPU usage, and a valgrind complaint

• Impact: backdoor access, remote code execution, and potential administrator access

• Tracking ID: CVE-2024-3094

• Severity: CVSS 10.0

What Freund noticed

The first clue was not a direct security alert. Freund observed unusually high CPU usage in sshd during login-related activity, which was out of line with expected behavior for the systems he was testing.

He also saw valgrind errors that suggested something deeper than ordinary instability. That combination of performance regression, instrumentation warnings, and suspicious liblzma behavior pushed the investigation from debugging into incident response.

Security teams often teach defenders to look for user-facing alerts, but supply-chain compromises can first surface as software anomalies; that is the same mindset behind broader guidance on software updates, where package changes deserve scrutiny even before an official security advisory appears.

Timeline

Long campaign

The effort to insert the backdoor is described as having stretched for more than two years, beginning in 2021. The operation involved social engineering, reputation-building, and sock puppetry around the project ecosystem, eventually placing the malicious contributor Jia Tan in a position of influence over releases.

The original upstream maintainer, Lasse Collin, faced sustained pressure and assistance patterns that later drew heavy scrutiny. The incident became a case study in how maintainer fatigue and trust-based workflows can be abused in open-source projects without needing an immediate code-level exploit.

March 2024 discovery

By late March 2024, vulnerable releases had already entered testing channels. Freund reported the issue first to Debian and then to the Openwall Project, where the public disclosure quickly helped distribution maintainers, vendors, and responders assess affected versions and start binary rebuild and rollback work.

He also publicly stated that he had accidentally found the problem while micro-benchmarking postgres changes and urged Debian testing and unstable users to upgrade as soon as possible.

Response and patch

Red Hat, SUSE, and Debian reverted affected packages to older safe versions. Canonical delayed the Ubuntu 24.04 LTS beta by one week to ensure the compromised package stream was handled safely.

A fixed release, version 5.6.2, was issued on 29 May 2024. By then, the incident had already become one of the clearest examples of a supply-chain backdoor stopped shortly before broader production systems exposure.

Affected systems

The most important detail is that this was not a universal compromise of every Linux machine. Exposure depended on package version, distribution packaging choices, whether the malicious build artifacts were included, and how OpenSSH, liblzma, and systemd-related integration were built and deployed.

Area	Status
XZ Utils 5.6.0	Affected
XZ Utils 5.6.1	Affected
Debian testing	Affected before broad production rollout
Debian unstable	Affected before broad production rollout
Ubuntu 24.04 LTS beta timeline	Postponed by one week
Older reverted package builds	Used for mitigation by major distributions
XZ Utils 5.6.2	Patched release

Why this incident mattered

The XZ incident showed that an open-source project can be compromised through maintainer trust, release engineering, and development version pathways rather than a visible source patch alone. That is why the event is regularly discussed alongside software supply-chain defense, maintainer security, and build reproducibility.

It also highlighted a practical lesson for defenders: strange latency, CPU usage spikes, and unexplained tool complaints can reveal a serious exploit before signatures exist. The same defensive thinking appears in adjacent topics like phishing attacks, where subtle operational clues matter more than flashy indicators.

Organizations involved

• Microsoft: Freund’s employer

• PostgreSQL: his long-standing development community

• Debian: one of the first ecosystems alerted

• Openwall Project: key venue for disclosure and technical coordination

• Red Hat, SUSE, Debian: reverted affected packages

• Canonical: delayed Ubuntu 24.04 LTS beta by one week

• CISA: part of the broader official response environment around CVE-2024-3094

Lessons for open-source security

The immediate lesson is that code review alone is not enough. Release artifacts, build scripts, testing branch changes, compressed assets, and maintainer governance all need scrutiny.

Projects that depend on volunteers and a small maintainer set are especially vulnerable to slow-burn social engineering. Similar debates show up wherever a platform tries to tighten trust boundaries, including consumer-facing anti-tamper efforts such as pc security changes that trade convenience for stronger integrity controls.

Practical takeaways

• Monitor performance regression reports as possible security signals.

• Treat unusual CPU usage in core services like sshd as an incident lead, not just a tuning issue.

• Review release artifacts, not only repository diffs.

• Use reproducible builds and binary rebuild verification where possible.

• Pay close attention to maintainer transitions and governance pressure.

• Track security advisory updates from distributions and infrastructure vendors.

FAQ

What did Andres Freund discover?

He discovered the XZ Utils backdoor in March 2024 after investigating abnormal CPU usage and valgrind errors involving sshd and liblzma.

Was Andres Freund working at Microsoft?

Yes. He is a Microsoft software engineer and also a PostgreSQL developer.

What was CVE-2024-3094?

CVE-2024-3094 is the identifier assigned to the XZ Utils backdoor. It carried a CVSS score of 10.0 because the compromise could enable remote code execution and privileged access under affected conditions.

Which versions were affected?

XZ Utils versions 5.6.0 and 5.6.1 were affected. Version 5.6.2 was released as the patched version on 29 May 2024.

Did this hit production Linux systems broadly?

The highest exposure was in testing and pre-release channels, especially Debian testing and Debian unstable, before wider production deployment. Distribution-level reversions helped prevent broader rollout.

Final take

Andres Freund is notable because he caught a high-impact supply-chain backdoor through disciplined systems work, not chance alone. For engineers, maintainers, and security teams, the practical next step is clear: treat odd behavior in core services, development version packages, and build outputs as potential security findings until proven otherwise.