loaxert/cve-2024-48990-pocProof-of-concept exploit for CVE-2024-48990, demonstrating local privilege escalation in needrestart via PYTHONPATH manipulation. Includes runner script and payload binary for testing.
Needrestart is a widely used utility on Linux systems (default on many Ubuntu versions) that checks after a software update whether any service or the system itself needs to be restarted. By analyzing running processes, it determines if they are using updated libraries or if they need to be restarted for changes to take effect.
When needrestart detects a process running a Python interpreter, it reads the environment variable PYTHONPATH associated with that process from /proc/[pid]/environ and then sets it before launching its own Python interpreter for analysis.
If the original process belongs to a local attacker, the attacker can manipulate PYTHONPATH to point to a malicious library.
As a result, when needrestart runs the Python interpreter with root privileges and the manipulated PYTHONPATH, it ends up executing the attacker’s code, leading to a privilege escalation to root.
This vulnerability affects only needrestart versions prior to 3.8. Versions 3.8 and later include a fix that properly sanitizes environment variables like PYTHONPATH before invoking the Python interpreter, preventing privilege escalation through malicious environment manipulation.
Clone the repository.
In runner.sh, modify the IP used to fetch the compiled binary so that it points to your own machine.
On the attacker’s machine, grant execute permissions and run binary.sh.
Set up an HTTP server:
$ python3 -m http.server
