Kompania Qualys identificoi tri dob\u00ebsi n\u00eb utilitarin needrestart, i destinuar p\u00ebr riaktivizimin e proceseve n\u00eb prapavij\u00eb pas p\u00ebrdit\u00ebsimit t\u00eb biblioteka q\u00eb p\u00ebrdoren nga proceset e t\u00eb dh\u00ebnave. Duke filluar nga Ubuntu 21.04, utilitari needrestart \u00ebsht\u00eb i p\u00ebrfshir\u00eb n\u00eb ambientin baz\u00eb t\u00eb Ubuntu Server, ku ekzekutohet me t\u00eb drejta root n\u00eb fund t\u00eb \u00e7do transaksioni t\u00eb menaxherit t\u00eb paketave APT, skanon proceset aktive dhe riaktivizon ato q\u00eb lidhen me skedar\u00ebt q\u00eb kan\u00eb ndryshuar pas p\u00ebrdit\u00ebsimit t\u00eb paketave. Dob\u00ebsit\u00eb e identifikuara lejojn\u00eb nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb fitoj\u00eb t\u00eb drejta root n\u00eb Ubuntu Server n\u00eb konfiguracionin e tij t\u00eb paracaktuar. <\/p>\n
D\u00ebmtimet jan\u00eb t\u00eb pranishme n\u00eb needrestart q\u00eb nga versioni 0.8 (viti 2014) dhe jan\u00eb rregulluar n\u00eb l\u00ebshimin needrestart 3.8. Problemet gjithashtu jan\u00eb zgjidhur tashm\u00eb n\u00eb shp\u00ebrndarjet Debian dhe Ubuntu. Si nj\u00eb anashkalim p\u00ebr t\u00eb bllokuar shfryt\u00ebzimin e t\u00eb metave, mund t\u00eb \u00e7aktivizoni skanimin e interpretueseve, duke specifikuar n\u00eb skedarin e konfigurimit \/etc\/needrestart\/needrestart.conf parametrin \"$nrconf{interpscan} = 0\". <\/p>\n
Dob\u00ebsit\u00eb jan\u00eb t\u00eb pranishme n\u00eb kodin me zbatimin e modit t\u00eb p\u00ebrcaktimit t\u00eb p\u00ebrdit\u00ebsimit t\u00eb skenareve, t\u00eb ekzekutuar duke p\u00ebrdorur interpretor\u00eb. Problemet e identifikuara: <\/p>\n
\n
CVE-2024-48990 \u2014 nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod me t\u00eb drejta root duke krijuar kushte p\u00ebr t\u00eb nisur interpretuesin Python me variabl\u00ebn e mjedisit PYTHONPATH t\u00eb vendosur nga sulmuesi. P\u00ebrve\u00e7 p\u00ebrdorimit t\u00eb Python, sulmi gjithashtu mund t\u00eb realizohet (CVE-2024-48992) p\u00ebrmes nisjes s\u00eb interpretuesit Ruby me variabl\u00ebn e mjedisit RUBYLIB.\n
D\u00ebmtimet shkaktohen nga fakti se gjat\u00eb rinisjes s\u00eb skenarit t\u00eb ndryshuar, utilitari needrestart vendos variabl\u00ebn e mjedisit PYTHONPATH n\u00eb p\u00ebrputhje me p\u00ebrmbajtjen e skedarit \/proc\/pid\/environ, q\u00eb p\u00ebrdoret p\u00ebr t\u00eb ekzekutuar kodin e vet Python. Si rrjedhoj\u00eb, sulmuesi mund t\u00eb pres\u00eb aktivitetin q\u00eb lidhet me pun\u00ebn e menaxherit t\u00eb paketave APT, t\u00eb simuloj\u00eb ndryshimin e skenarit t\u00eb tij dhe t\u00eb vendos\u00eb p\u00ebr t\u00eb variabl\u00ebn mjedisore PYTHONPATH, e cila gjithashtu do t\u00eb aplikohet gjat\u00eb ekzekutimit t\u00eb kodit Python t\u00eb integruar n\u00eb needrestart (\"import sys\nprint(sys.path)\"), e cila ekzekutohet me t\u00eb drejtat root. <\/p>\n
P\u00ebr shembull, p\u00ebr t\u00eb shfryt\u00ebzuar t\u00eb met\u00ebn, mund t\u00eb nisni nj\u00eb proces Python q\u00eb q\u00ebndron vazhdimisht n\u00eb kujtes\u00eb, duke vendosur p\u00ebr t\u00eb variabl\u00ebn mjedisore \"PYTHONPATH=\/home\/test\", dhe t\u00eb vendosni bibliotek\u00ebn e p\u00ebrbashk\u00ebt \"home\/test\/importlib\/__init__.so\", q\u00eb do t\u00eb ekzekutohet gjat\u00eb ekzekutimit t\u00eb kodit privilegjuar Python n\u00eb needrestart. <\/p>\n
CVE-2024-48991 \u2014 nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod me t\u00eb drejta root duke inicuar nj\u00eb gjendje gar\u00eb (race condition), rezultati i s\u00eb cil\u00ebs \u00ebsht\u00eb se needrestart do t\u00eb nis\u00eb nj\u00eb interpretues Python fantazm\u00eb t\u00eb vendosur nga sulmuesi, n\u00eb vend t\u00eb interpretuesit sistemik Python. Thelbi i t\u00eb met\u00ebs \u00ebsht\u00eb i ngjash\u00ebm me problemin e p\u00ebrmendur m\u00eb sip\u00ebr, ndryshimi \u00ebsht\u00eb vet\u00ebm se needrestart p\u00ebrcakton emrin e procesit Python (p.sh., \/usr\/bin\/python3) p\u00ebrmes leximit t\u00eb \"\/proc\/pid\/exe\".\n
P\u00ebr shfryt\u00ebzimin e dob\u00ebsis\u00eb, mund t\u00eb krijoni nj\u00eb proces \"\/home\/test\/race\", i cili n\u00ebp\u00ebrmjet mekanizmit inotify do t\u00eb pres\u00eb momentin kur needrestart fillon t\u00eb lexoj\u00eb p\u00ebrmbajtjen e \"\/proc\/pid\/exe\", dhe menj\u00ebher\u00eb do t\u00eb startoj\u00eb interpretuesin sistemor Python p\u00ebrmes funksionit execve. Duke qen\u00eb se needrestart nuk b\u00ebn verifikimin n\u00ebse ky \u00ebsht\u00eb me t\u00eb v\u00ebrtet\u00eb Python, ai do ta konsideroj\u00eb \"\/home\/test\/race\" si interpretues Python dhe do ta startoj\u00eb at\u00eb p\u00ebr kodin e tij. <\/p>\n
CVE-2024-11003 \u2014 nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb ekzekutimin e komandave t\u00eb rast\u00ebsishme shell me t\u00eb drejtat root duke krijuar kushte p\u00ebr trajtimin n\u00eb needrestart t\u00eb emrave t\u00eb skedar\u00ebve n\u00eb formatin \u00abkomand\u00eb|\u00bb, ku kalimi i tyre n\u00eb funksionin Perl open() do t\u00eb sjell\u00eb ekzekutimin e komand\u00ebs. N\u00eb fakt, vulnerabiliteti shfaqet n\u00eb modulin Perl ScanDeps (CVE-2024-10224), por shkaktohet nga kalimi n\u00eb k\u00ebt\u00eb modul i parametrave t\u00eb jasht\u00ebm pa verifikim t\u00eb duhur.\n
Sulmi mund t\u00eb realizohet p\u00ebrmes ekzekutimit t\u00eb nj\u00eb skripti Perl me simbolin \u00ab|\u00bb n\u00eb em\u00ebr, p\u00ebr shembull, \u00ab\/home\/test\/perl|\u00bb. Gjat\u00eb ekzekutimit t\u00eb funksionit scan_deps() n\u00eb needrestart, ky skedar do t\u00eb hapet p\u00ebrmes funksionit open(), i cili do ta trajtoj\u00eb simbolin \u00ab|\u00bb si nj\u00eb flag p\u00ebr ekzekutimin e programit \u00ab\/home\/test\/perl\u00bb dhe p\u00ebrdorimin e rrjedh\u00ebs s\u00eb daljes nga ky program. <\/ul>\n