{"id":120608,"date":"2024-11-20T01:09:18","date_gmt":"2024-11-19T23:09:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-needrestart-pozvolyayushhie-poluchit-root-dostup-v-ubuntu-server"},"modified":"2024-11-20T01:09:18","modified_gmt":"2024-11-19T23:09:18","slug":"uyazvimosti-v-utilite-needrestart-pozvolyayushhie-poluchit-root-dostup-v-ubuntu-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-utilite-needrestart-pozvolyayushhie-poluchit-root-dostup-v-ubuntu-server","title":{"rendered":"Vulnerabilities in the needrestart utility allow root access in Ubuntu Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Qualys has identified three vulnerabilities in the needrestart utility, which is designed to restart background processes after updating the libraries used by those processes. Starting with Ubuntu 21.04, the needrestart utility is included in the base environment of Ubuntu Server, where it runs with root privileges at the end of each APT package manager transaction, scans running processes, and restarts those associated with files that have changed after package updates. The identified vulnerabilities allow a local unprivileged user to gain root privileges on Ubuntu Server in a default configuration. <\/p>\n
Vulnerabilities are present in needrestart starting from version 0.8 (2014) and have been fixed in the needrestart 3.8 release. The issues have also been addressed in the Debian and Ubuntu distributions. As a workaround to block the exploitation of the vulnerability, you can disable interpreter scanning by specifying the parameter $nrconf{interpscan} = 0 in the configuration file \/etc\/needrestart\/needrestart.conf. <\/p>\n
Vulnerabilities are present in the code implementing the detection mode for updates of scripts run using interpreters. The identified issues are: <\/p>\n
\n
CVE-2024-48990 \u2014 a local user can achieve code execution with root privileges by creating conditions to launch the Python interpreter with the attacker's environment variable PYTHONPATH set. In addition to Python, the attack can also be conducted (CVE-2024-48992) by launching the Ruby interpreter with the environment variable RUBYLIB.\n
The vulnerabilities are caused by the fact that during the restart of a modified script, the needrestart utility sets the PYTHONPATH environment variable based on the contents of the \/proc\/pid\/environ file, which it then uses to launch its own Python code. Accordingly, an attacker can wait for activity related to the APT package manager, simulate a change in their script, and set the PYTHONPATH environment variable, which will also be applied when executing the built-in Python code in needrestart (\"import sys\\nprint(sys.path)\") running with root privileges. <\/p>\n
For example, to exploit the vulnerability, a continuously running Python process can be launched with the environment variable \"PYTHONPATH=\/home\/test\" set, and a shared library \"\\\/home\\\/test\\\/importlib\\\/__init__.so\" can be placed, which will be executed when the privileged Python code in needrestart is run. <\/p>\n
CVE-2024-48991 \u2014 a local user can achieve code execution with root privileges by initiating a race condition, resulting in needrestart starting a fake Python interpreter provided by the attacker instead of the system's Python interpreter. The essence of the vulnerability is similar to the previously mentioned issue, the only difference being that needrestart determines the name of the Python process (for example, \/usr\/bin\/python3) by reading \"\/proc\/pid\/exe.\"\n
To exploit the vulnerability, a process \/home\/test\/race can be created, which will wait for needrestart to start reading the contents of \/proc\/pid\/exe using the inotify mechanism and then immediately launch the system Python interpreter through the execve function. Since needrestart does not verify whether this is indeed Python, it will consider \/home\/test\/race as the Python interpreter and execute it for its code. <\/p>\n
CVE-2024-11003 \u2014 a local user can achieve the execution of arbitrary shell commands with root privileges by creating conditions for processing in needrestart file names in the format of 'command|', which, when passed to the Perl function open(), will lead to the execution of the command. The vulnerability is actually manifested in the Perl module ScanDeps (CVE-2024-10224), but it is caused by passing external parameters to this module without proper validation.\n
The attack can be carried out by launching a Perl script with the '|' character in the name, for example, '\/home\/test\/perl|'. During the execution of the scan_deps() function in needrestart, this file will be opened via the open() function, which will treat the '|' character as a flag to launch the program '\/home\/test\/perl' and use the output stream obtained from this program. <\/ul>\n