Qualys has identified three vulnerabilities in the needrestart utility, which is designed to restart background processes after updating the libraries used by those processes. Starting with Ubuntu 21.04, the needrestart utility is included in the base environment of Ubuntu Server, where it runs with root privileges at the end of each APT package manager transaction, scans running processes, and restarts those associated with files that have changed after package updates. The identified vulnerabilities allow a local unprivileged user to gain root privileges on Ubuntu Server in a default configuration.
The vulnerabilities have existed in needrestart since version 0.8 (2014) and have been patched in needrestart release 3.8. The issues have also been fixed in Debian and Ubuntu distributions. As a workaround to block the exploitation of the vulnerabilities, one can disable interpreter scanning by setting the parameter "$nrconf{interpscan} = 0" in the configuration file /etc/needrestart/needrestart.conf.
Vulnerabilities are present in the code implementing the detection mode for updates of scripts run using interpreters. The identified issues are:
- CVE-2024-48990 — a local user can achieve code execution with root privileges by creating conditions to launch the Python interpreter with an attacker-specified environment variable PYTHONPATH. In addition to Python, the attack can also be conducted (CVE-2024-48992) by launching the Ruby interpreter with the environment variable RUBYLIB.
The vulnerabilities are caused by the needrestart utility setting the PYTHONPATH environment variable based on the contents of the file /proc/pid/environ during the restart process of the modified script, which it then uses to launch its own Python code. Consequently, an attacker can wait for activity related to the APT package manager, simulate a change in their script, and set the PYTHONPATH environment variable, which will also apply when executing the embedded Python code in needrestart ("import sys\n print(sys.path)"), executed with root privileges.
For example, to exploit the vulnerability, a Python process can be started that remains running in memory, by setting the environment variable "PYTHONPATH=/home/test", and placing the shared library "/home/test/importlib/__init__.so", which will be executed when privileged Python code in needrestart is run.
- CVE-2024-48991 - a local user can achieve code execution with root privileges by triggering a race condition, resulting in needrestart launching a fake Python interpreter provided by the attacker instead of the system Python interpreter. The nature of the vulnerability is similar to the aforementioned issue; the difference is that needrestart determines the name of the Python process (e.g., /usr/bin/python3) by reading "/proc/pid/exe".
To exploit the vulnerability, a process /home/test/race can be created, which will wait for needrestart to start reading the contents of /proc/pid/exe using the inotify mechanism and then immediately launch the system Python interpreter through the execve function. Since needrestart does not verify whether this is indeed Python, it will consider /home/test/race as the Python interpreter and execute it for its code.
- CVE-2024-11003 - a local user can achieve execution of arbitrary shell commands with root privileges by creating conditions for needrestart to handle file names in the format "command|", the passing of which to the Perl function open() will lead to the execution of the command. In fact, the vulnerability manifests in the Perl module ScanDeps (CVE-2024-10224), but is caused by passing external parameters to this module without proper validation.
An attack can be carried out by launching a Perl script with a "|" character in its name, for example, "/home/test/perl|". During the execution of the scan_deps() function in needrestart, this file will be opened through the open() function, which will treat the "|" character as a flag to execute the program "/home/test/perl" and use the output stream provided by that program.
Source: opennet.ru
