CVE-2024-48990 PoC — needrestart 安全漏洞

Source

Associated Vulnerability

Description

Needrestart, prior to version 3.8, contains a vulnerability that allows local attackers to execute arbitrary code with root privileges. This is achieved by manipulating the PYTHONPATH environment variable to trick needrestart into running the Python interpreter in an unsafe context.

Readme

## Proof of Concept (PoC) for CVE-2024-48990 in `needrestart`

**CVE-2024-48990**: Linux Local Privilege Escalation (LPE) via `needrestart`

- **Patched**: Nov 19, 2024
- **More Information**: [Qualys Advisory](https://www.qualys.com/2024/11/19/needrestart/needrestart.txt)

---

## How to Use?

1. Run the script `./start.sh`.
   - This will compile a malicious `importlib` library.
   - It will then start a Python script (`e.py`) that sets up a listener and waits for `needrestart` to be executed by the `root` user.

2. When `needrestart` is triggered (typically by an update like `apt upgrade`), it will load the fake library and execute the payload.

3. Upon successful execution, a shell will be opened.

---

File Snapshot

 [4.0K]  /data/pocs/6d85eaf0a6a79f1fa4c60a5696aae7de4c587d86
├── [ 323]  e.py
├── [ 553]  lib.c
├── [ 716]  README.md
└── [ 241]  start.sh

0 directories, 4 files

Remarks