TL;DR: Update immediately, especially if SSH is enabled. xz versions 5.6.0 & 5.6.1 are impacted. The article contains links to each distro's specific instructions of what to do.
https://news.opensuse.org/2024/03/29/xz-backdoor/
Current research indicates that the backdoor is active in the SSH Daemon, allowing malicious actors to access systems where SSH is exposed to the internet.
In summary, the conditions for exploitation seem to be:
- xz version 5.6.0 or 5.6.1
- SSH with a patch that causes xz to be loaded
- SSH daemon enabled
Impact on distros
-
Arch Linux: Backdoor was present, but shouldn't be able to activate. Updating is still strongly recommended.
-
Debian: Testing, Unstable, and Experimental are affected (update to xz-utils version 5.6.1+really5.4.5-1). Stable is not affected.
-
Fedora: 41 is affected and should not be used. Fedora 40 may be affected (check the version of xz). Fedora 39 is not affected.
-
FreeBSD: Not affected.
-
Kali: Affected.
-
NixOS: NixOS unstable has the backdoor, but it should not be able to activate. NixOS stable is not affected.
-
OpenSUSE: Tumbleweed and MicroOS are affected. Update to liblzma5 version 5.6.1.revertto5.4. Leap is not affected.
CVE-2024-3094
I guess it kind of depends. Not really sure what most people actually use, but for those who use MS's services, Office web isn't great, and Skype for Linux is rather temperamental. A lot of games work under Proton, but not all.
My perception of "average user" is probably skewed towards being not technical enough to troubleshoot on their own, but skilled enough to run through a tutorial of what keys to press. For someone used to Windows, patching things up is simpler than learning all the ins and outs of a new OS.
I don't disagree that most people would be fine using Linux, but there needs to be a compelling reason why Linux would be significantly better, or else the switching cost makes it not worthwhile.