======================================================================== CVE-2024-48990 (and CVE-2024-48992)

To determine whether a Python process (a process that is running the Python interpreter) needs to be restarted, needrestart extracts the PYTHONPATH environment variable from this process's /proc/pid/environ (at line 193), sets this environment variable if it exists (at line 196), and executes Python ("$ptable->{exec}" at line 203) with a "-" argument to read a short, hard-coded script from stdin (at line 204):

---

""" perl 135 sub files { 136 my $self = shift; 137 my $pid = shift; 138 my $cache = shift; 139 my $ptable = nr_ptable_pid($pid); ... 193 my %e = nr_parse_env($pid); 194 local %ENV; 195 if(exists($e{PYTHONPATH})) { 196 $ENV{PYTHONPATH} = $e{PYTHONPATH}; 197 } ... 203 my ($pyread, $pywrite) = nr_fork_pipe2($self->{debug}, $ptable->{exec}, '-'); 204 print $pywrite "import sys\nprint(sys.path)\n"; 205 close($pywrite); """

Unfortunately, if a Python process belongs to a local attacker, then needrestart executes Python (at line 203) with an attacker-controlled PYTHONPATH environment variable, which allows the attacker to execute arbitrary code as root (even though needrestart's hard-coded Python script at line 204 is not attacker-controlled at all). This is CVE-2024-48990.