Five Privilege Escalation Flaws Found in Ubuntu needrestart
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-10224 | Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary s Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval(). NVD description · AI analysis pending | 7.8 | 9% | PoC ×3 |
| — | |
| CVE-2024-48990 | Local Privilege Escalation in Ubuntu needrestart via attacker-controlled PYTHONPATH CVE-2024-48990 is an uncontrolled search path flaw (CWE-427) in needrestart, the tool used on Ubuntu and Debian systems to check which services need restarting, affecting all versions before 3.8. A local attacker with low privileges can set the PYTHONPATH environment variable so that when needrestart executes the Python interpreter with root privileges, the attacker's code is loaded and run as root. Successful exploitation yields arbitrary code execution as root, giving the attacker full control of the affected machine. Any server, workstation, or container image running needrestart prior to 3.8 — most notably Ubuntu systems, where the package is shipped and maintained — is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, though EPSS assigns an elevated 20.5% probability of exploitation within 30 days (97th percentile). Do: Upgrade needrestart to version 3.8 or later using your distribution's security updates (Ubuntu packages are issued by the Ubuntu security team). Administrators should audit installed systems (e.g., check the needrestart package version) and, as an interim mitigation, restrict local unprivileged access and be cautious running needrestart in environments where users can control environment variables. Given the elevated EPSS score, prioritize patching multi-user servers where local accounts or untrusted code can run. | 7.8 | 20% |
| masswell over 1,000,000 installations; plausibly tens of millions of systems |
Full article321 words · extracted from infosecurity-magazine.com · click to collapse
Five Local Privilege Escalation (LPE) vulnerabilities in Ubuntu Server’s needrestart utility have been discovered. These flaws, found by the Qualys Threat Research Unit (TRU), affect versions prior to 3.8, enabling unprivileged users to escalate their privileges to root without requiring user interaction.
Understanding the needrestart Vulnerabilities
The vulnerabilities are tracked as:
- CVE-2024-48990
- CVE-2024-48991
- CVE-2024-48992
- CVE-2024-10224
- CVE-2024-11003
These originate from unsafe handling of attacker-controlled environment variables. These variables influence the Python and Ruby interpreters during needrestart’s execution, allowing arbitrary shell commands to be run as root.
The flaws have been present since version 0.8 of the utility was released in 2014.
needrestart is a critical utility installed by default on Ubuntu Server since version 21.04. It determines whether a system or its services need restarting after updates to shared libraries, ensuring services utilize the latest versions without requiring a full reboot.
Despite its functionality improving uptime and efficiency, its widespread integration makes these vulnerabilities a global concern for enterprises relying on Ubuntu Server.
How to Mitigate the Risk
Updating to needrestart version 3.8 eliminates the vulnerabilities. For immediate risk mitigation, users can disable the interpreter scanning feature by modifying the utility’s configuration file. Specifically, adding the line $nrconf{interpscan} = 0; to the configuration file will deactivate this vulnerable feature.
Addressing these vulnerabilities is critical to prevent unauthorized access to sensitive data, malware installation and operational disruptions. Such incidents could compromise compliance, customer trust and organizational reputation.
The Importance of Proactive Security Measures
More generally, Qualys warned that organizations are encouraged to adopt a proactive approach to vulnerability management by regularly identifying and prioritizing critical vulnerabilities.
Implementing robust patch management processes and monitoring systems for signs of exploitation are key steps in mitigating risks. Enterprises should also consider disabling features that are not immediately necessary to minimize exposure to attacks.
Image credit: Ralf Liebhold / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/5-privilege-escalation-flaws/