Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.## Proof of Concept (PoC) for CVE-2024-48990 in `needrestart`
**CVE-2024-48990**: Linux Local Privilege Escalation (LPE) via `needrestart`
- **Patched**: Nov 19, 2024
- **More Information**: [Qualys Advisory](https://www.qualys.com/2024/11/19/needrestart/needrestart.txt)
---
## How to Use?
1. Run the script `./start.sh`.
- This will compile a malicious `importlib` library.
- It will then start a Python script (`e.py`) that sets up a listener and waits for `needrestart` to be executed by the `root` user.
2. When `needrestart` is triggered (typically by an update like `apt upgrade`), it will load the fake library and execute the payload.
3. Upon successful execution, a shell will be opened.
---
[4.0K] /data/pocs/9da33f5021c70061406cb6a54e72281e61c1ded2
├── [ 323] e.py
├── [ 553] lib.c
├── [ 716] README.md
└── [ 241] start.sh
0 directories, 4 files