XZ Utils is a data compression software that may be present in Linux distributions. A malicious code was discovered in the upstream tarballs of xzthat may allow unauthorized access to affected systems.

The liblzma(part of the xz package) build process extracts a prebuilt object file from a disguised test file existing in the source code through a series of complex obfuscations, which is then used to modify specific functions in the liblzma code.

The resulting malicious build interferes with authentication in sshd via systemd and could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.