Kompania Qualys zbuloi tre vulnerabilitete n\u00eb utilitarin needrestart, i destinuar p\u00ebr t\u00eb rinisur proceset n\u00eb sfond pas azhurnimit t\u00eb librarive t\u00eb p\u00ebrdorura nga proceset n\u00eb fjal\u00eb. Duke filluar nga Ubuntu 21.04, utilitari needrestart \u00ebsht\u00eb i p\u00ebrfshir\u00eb n\u00eb mjedisin baz\u00eb t\u00eb Ubuntu Server, ku fillohet me t\u00eb drejtat e root n\u00eb fund t\u00eb \u00e7do transaksioni t\u00eb menaxherit t\u00eb paketave APT, skanon proceset aktive dhe rinis ato q\u00eb lidhen me skedar\u00ebt e ndryshuar pas azhurnimit t\u00eb pakove. Vulnerabilitetet e zbuluara lejojn\u00eb nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb fitoj\u00eb t\u00eb drejtat e root n\u00eb Ubuntu Server n\u00eb konfigurimin e tij t\u00eb paracaktuar. <\/p>\n
Dobitjet nga versioni 0.8 (2014) i needrestart, paraqiten vulnerabilitete q\u00eb jan\u00eb riparuar n\u00eb l\u00ebshimin e needrestart 3.8. Problemet gjithashtu jan\u00eb zgjidhur n\u00eb shp\u00ebrndarjet Debian dhe Ubuntu. Si nj\u00eb ndihm\u00eb, p\u00ebr t\u00eb bllokuar shfryt\u00ebzimin e vulnerabilitetit, mund t\u00eb \u00e7aktivizoni skanimin e interpretoresh, duke e vendosur parametrin n\u00eb skedarin e konfigurimit \/etc\/needrestart\/needrestart.conf «$nrconf{interpscan} = 0». <\/p>\n
Vulnerabilitetet jan\u00eb t\u00eb pranishme n\u00eb kodin me realizimin e modit t\u00eb identifikimit t\u00eb azhurnimit t\u00eb skripteve, t\u00eb cilat jan\u00eb t\u00eb nisura duke p\u00ebrdorur interpretuese. Problemet e zbuluara jan\u00eb: <\/p>\n
\n
CVE-2024-48990 — nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb ekzekutimin e kodit me t\u00eb drejta root duke krijuar kushte p\u00ebr t\u00eb nisur interpretuesin Python me variablin mjedisor t\u00eb vendosur nga sulmuesi PYTHONPATH. P\u00ebrve\u00e7 p\u00ebrdorimit t\u00eb Python, sulmi gjithashtu mund t\u00eb realizohet (CVE-2024-48992) duke nisur interpretuesin Ruby me variablin mjedisor RUBYLIB.\n
Vulnerabilitetet shkaktohen nga fakti se, gjat\u00eb rinisjes s\u00eb skriptit t\u00eb ndryshuar, utilitarja needrestart vendos variablin mjedisor PYTHONPATH bazuar n\u00eb p\u00ebrmbajtjen e skedarit \/proc\/pid\/environ, t\u00eb cilin e p\u00ebrdor gjithashtu p\u00ebr t\u00eb nisur kodin e vet Python. Si rrjedhoj\u00eb, sulmuesi mund t\u00eb pres\u00eb aktivitetin e lidhur me menaxherin e paketave APT, t\u00eb simuloj\u00eb ndryshimin e skriptit t\u00eb tij dhe t\u00eb vendos\u00eb variablin mjedisor PYTHONPATH, e cila do t\u00eb aplikohet gjithashtu gjat\u00eb ekzekutimit t\u00eb kodit t\u00eb integruar Python n\u00eb needrestart («import sys\n print(sys.path)»), q\u00eb ekzekutohet me t\u00eb drejta root. <\/p>\n
P\u00ebr shembull, p\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetin, mund t\u00eb nisni nj\u00eb proces Python q\u00eb q\u00ebndron vazhdimisht n\u00eb memorje, duke vendosur p\u00ebr t\u00eb variabl\u00ebn mjedisor «PYTHONPATH=\/home\/test», dhe t\u00eb vendosni bibliotek\u00ebn e ndar\u00eb «\/home\/test\/importlib\/__init__.so», e cila do t\u00eb ekzekutohet n\u00eb momentin e ekzekutimit t\u00eb kodit Python me privilegje n\u00eb needrestart. <\/p>\n
CVE-2024-48991 — nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb ekzekutimin e kodit me t\u00eb drejta root duke iniciuar nj\u00eb gjendje gar\u00eb (race condition), si pasoj\u00eb e s\u00eb cil\u00ebs needrestart do t\u00eb nis\u00eb nj\u00eb interpretues Python fals t\u00eb vendosur nga sulmuesi, n\u00eb vend t\u00eb interpretuesit sistemor Python. Esenca e vulnerabilitetit \u00ebsht\u00eb e ngjashme me problemin e p\u00ebrmendur m\u00eb sip\u00ebr, me ndryshimin se needrestart p\u00ebrcakton emrin e procesit Python (p.sh., \/usr\/bin\/python3) duke lexuar «\/proc\/pid\/exe».\n
P\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetin, mund t\u00eb krijoni nj\u00eb proces \/home\/test\/race, i cili p\u00ebrmes mekanizmit inotify do t\u00eb pres\u00eb momentin kur needrestart fillon t\u00eb lexoj\u00eb p\u00ebrmbajtjen e \/proc\/pid\/exe, dhe menj\u00ebher\u00eb t\u00eb nis\u00eb interpretorin sistemik Python p\u00ebrmes funksionit execve. Duke pasur parasysh se needrestart nuk b\u00ebn verifikimin n\u00ebse ky \u00ebsht\u00eb realmente Python, do ta konsideroj\u00eb se \/home\/test\/race \u00ebsht\u00eb interpretor Python dhe do ta nis\u00eb at\u00eb p\u00ebr kodin e tij. <\/p>\n
CVE-2024-11003 — nj\u00eb p\u00ebrdorues lokal mund t\u00eb arrij\u00eb ekzekutimin e komandave t\u00eb rast\u00ebsishme t\u00eb shell-it me t\u00eb drejta root duke krijuar kushte p\u00ebr trajtimin n\u00eb needrestart t\u00eb emrave t\u00eb skedar\u00ebve n\u00eb formatin «komanda|», transmetimi i t\u00eb cilave n\u00eb funksionin Perl open() do t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e komand\u00ebs. N\u00eb fakt, vulnerabiliteti shfaqet n\u00eb modulin Perl ScanDeps (CVE-2024-10224), por shkaktohet nga transmetimi i parametrave t\u00eb jasht\u00ebm n\u00eb k\u00ebt\u00eb modul pa kontroll t\u00eb duhur.\n
Sulmi mund t\u00eb realizohet p\u00ebrmes nisjes s\u00eb skriptit Perl me simbolin «|» n\u00eb em\u00ebr, p\u00ebr shembull, «\/home\/test\/perl|». Gjat\u00eb ekzekutimit t\u00eb funksionit scan_deps() n\u00eb needrestart, ky skedar do t\u00eb hapet p\u00ebrmes funksionit open(), i cili do t\u00eb trajtoj\u00eb simbolin «|» si nj\u00eb flamur p\u00ebr t\u00eb nisur programin «\/home\/test\/perl» dhe p\u00ebr t\u00eb p\u00ebrdorur rrjedh\u00ebn e daljes nga ky program. <\/ul>\n