CVE-2024-48990 PoC — needrestart 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2024-48990

# introdution

This vulnerability takes advantage of the way in which needrestart manages the environment variable, to be more precise, PYTHONPATH can be hijacked by modifying the PYTHONPATH variable to a directory that contains a malicious library, thus executing and gaining access, we can have suid problems in some directories, so define in evil.c the following structure "sudo mount -o remount,suid /tmp" so we will be able to obtain root when executing /tmp/nullbyte -p.


# Execution Exploit

```bash
PYTHONPATH=/tmp python3 get_root.py
```
now, wait sysadmin update system or execute needrestart version 3.7, remember target need have version 3.7 needrestart

File Snapshot

 [4.0K]  /data/pocs/36ecab3a63bde71bc4ce5d85f0dbf8b32f00a6cc
├── [ 290]  evil.c
├── [ 723]  get_root.py
└── [ 685]  README.md

0 directories, 3 files

Remarks