CVE-2024-48990

CVE-2024-48990 POC Overview Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. This repository contains a...

CVE-2024-48990-PoC

CVE-2024-48990-PoC 什么是 needrestart 及其工作原理？ Needrestart 是 Linux 系统上广泛使用的工具（默认安装在许多 Ubuntu 版本中），它在软件更新后检查是否有服务或系统本身需要重启。通过分析正在运行的进程，它判断这些进程是否使用了更新后的库，或者是否需要重启以使更改生效。 漏洞是如何工作的？ 当 needrestart 检测到进程正在运行 Python 解释器时，它从 /proc/pid/environ 读取该进程关联的环境变量 PYTHONPATH，然后在启动自己的 Python 解释器进行分析之前设置该变量。...

EUVD-2012-5542

Malware in sbrugna...

The vulnerability of the needrestart utility, related to the uncontrolled element in the search process, allows a hacker to execute arbitrary code in the context of the root user.

The vulnerability of the needrestart utility is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the root user by manipulating the PYTHONPATH variable during Python initialization...