CVE-2024-48990 - Needrestart 3.7-3 Privilege Escalation Exploit

Overview

This repository contains an exploit for CVE-2024-48990, a privilege escalation vulnerability in Needrestart 3.7-3. The exploit leverages improper input handling to execute arbitrary code with elevated privileges.

Affected Versions

• Needrestart 3.7-3 (Tested on Debian-based systems)
• Other versions may also be vulnerable

Exploit Details

The exploit consists of:

• main.asm: Assembly shellcode used for privilege escalation.
• listener.sh: Python-based listener for monitoring exploitation success.
• Makefile: Automates the compilation and execution of the exploit.

Exploitation Steps

1. Clone the Repository

git clone https://github.com/ten-ops/CVE-2024-48990.git
cd CVE-2024-48990

2. Compile and Execute

make

This will:

• Assemble and link the shellcode.
• Create a malicious shared object (__init__.so) inside /tmp/attacker/importlib/.
• Execute the listener.sh script to monitor the attack.

3. Trigger the Exploit

To trigger the exploit, execute the following command:

sudo needrestart -r a

This forces Needrestart to load the malicious shared object, resulting in privilege escalation.

4. Verify Exploitation Success

If successful, you should see:

Root obtained!, clear traces ...

Why This Attack is Effective on Multi-User Ubuntu Servers

1. Needrestart is often executed by administrators when updating or patching the server.

2. If the attacker injects the payload before an admin runs needrestart, they gain root without direct sudo access.

3. This is known as "privilege escalation by waiting" (time-of-use attack).

Mitigation

To mitigate this vulnerability:

• Upgrade Needrestart to the latest patched version.
• Restrict execution of untrusted binaries by enforcing strict sudo policies.
• Monitor /tmp/ and /var/tmp/ for suspicious activity.

Disclaimer

This exploit is for educational and research purposes only. Unauthorized use may violate applicable laws. The author is not responsible for any misuse.

References

• CVE Details
• Mitre

SEO Optimization Tags:

CVE-2024-48990, Needrestart Exploit, Linux Privilege Escalation, Needrestart 3.7-3 Vulnerability, Linux Security, Ethical Hacking, Red Teaming, Root Exploit, Assembly Exploit, Cybersecurity Research