Security researchers from Qualys TRU has discovered vulnerabilities in a utility package in Ubuntu OS that could enable local users to escalate their privileges to root without user interaction.
In total there are five vulnerabilities were discovered affecting the utility, needrestart, that is designed to scan the system for any services that need to be restarted after a new software installation, upgrade or removal, potentially preventing the need for a full system restart. Attackers can exploit this utility that runs with root privileges by using any of the four methods discovered by Qualys, one of which takes advantage of two separate flaws, to execute their own code as root.
The researchers determined that these flaws have been present in needrestart since version 0.8, which was released in April 2014. The package can be manually installed on any Ubuntu release, but has also been installed by default on all Ubuntu Server images since 21.04, which was released in April 2021.
The first vulnerability tracked as CVE-2024-48990 with a CVSS score of 7.8, the Python interpreter used by needrestart can be made to execute arbitrary Python code planted in a shared library on the target system. This is done by running a Python process with a PYTHONPATH directing back to the location of the attacker-controlled library.
The second vulnerability tracked as CVE-2024-48991 with a CVSS score of 7.8, involves a time-of-check, time-of-use (TOCTOU) race condition in which there is enough time between when needrestart checks the location of the Python interpreter and when it executes the interpreter for an attacker to redirect needrestart to its own fake interpreter.
The third vulnerability tracked as CVE-2024-48992 with a CVSS score of 7.8, is same as the CVE-2024-48990 but involves the Ruby interpreter and can be achieved by running the interpreter with an attacker-controlled RUBYLIB environment variable.
The fourth vulnerability that combines CVE-2024-11003 and CVE-2024-10224 with a CVSS score of 5.3, causes the ScanDeps module to execute arbitrary shell commands contained in an attacker-controlled file name. This is due to a combination of the failure to sanitize file names passed to ScanDeps (CVE-2024-11003) and the fact that ScanDeps recognizes file names containing a pipe character (“|”) as commands to be executed (CVE-2024-10224).
Ubuntu maintainer Canonical released upgrades that include fixes for both the needrestart and libmodule-scandeps-perl flaws and strongly recommended users apply these upgrades in order to fix both affected packages.
If immediate upgrade is not possible, modify the needrestart configuration file to disable the use of interpreter scanners. These modifications may prevent other updates from completing successfully and will need to be reverted after the full fix of the vulnerabilities is applied.
