Overview

vulnerablities discovered by Qualys in the needrestart package, covering topics

from confused deputies to the inner workings of the /proc filesystem and

responsible disclosure as well.

Deep dive into needrestart local privilege escalation vulnerabilities

different local privilege escalation vulnerablities in needrestart

system services if one of the libraries or the service itself was updated

(jammy) or 24.04 LTS (noble) would be affected - and is integrated into apt so

that it runs at the end of an apt install/upgrade/remove or via

unattended-upgrades (which again is installed by default to install security

updates automatically every 24 hours)

it to execute code of their chosing, can achieve local privilege escalation

the next time it runs

controlled Python interpreter instead of the system-installed one

containing a pipe - which in turn causes Perl to execute a shell pipeline

with the filename as input and hence code execution

into memory of each process and match these against newly updated/installed

packages - if it sees that one of the shared objects for a given process got

updated it will then be restarted

by the interpreter and from that looks at import statements to determine

which files are likely being used

message “Scanning processes…” whilst doing and apt upgrade and wondered what

that was - and if they controlled a process, whether they could then influence

the behaviour of it

interpreter when it imports files

custom path to import from - so needrestart looks this up from

/proc/pid/environ and executes the Python interpreter with this same value

to get it to resolve the imports to files on disk

process - classic case of a Confused Deputy - lower privileged application is

able to trick a higher privileged application into misusing its authority on

the system - so can set their own PYTHONPATH, and since Python will happy load

any __init__.so files from that path, the attacker controlled shared object

is then executed by Python running as root via needrestart

env var) may also be affected and subsequently confirmed this to be the case

PYTHONPATH used by the interpreter, is about the interpreter binary itself

looking at its /proc/pid/exe entry - matches this against a regex like

/usr/bin/python - back in 2022 Jakub Wilk discovered a vuln where the regex

was not anchored, so if a process was running via a attacker controlled

interpreter (/home/amurray/usr/bin/python) this would match and

needrestart would execute that interpreter directly as root - CVE-2022-30688

twice - once early on when collecting info on all processes, and then a

second time to determine if it is say a Python application - but when

needrestart goes and executes this interpreter to do the PYTHONPATH lookups

etc, it uses the original value that it collected at the start of its run

at startup, then wait for needrestart to probe that (using say inotify to be

notified when it is accessed) and then quickly exec() the real system Python

interpreter and hence change its /proc/self/exe to trick needrestart -

which will then go and execute its original malicious interpreter binary

looking at the Perl parts

Perl interpreter to resolve “imports” etc

(coined in 1999 by rain.forest.puppy in Phrack)

pipe (|) and it will instead execute that string as a shell command

the way in its analysis - and since these filenames are controlled by the

unprivileged attacker, can create a file which ends in a pipe character

(e.g. /home/amurray/bin/pwned|) and Perl will then just execute that

script directly

these files as well - directly executing whatever strings found as Perl code

needrestart developer involved to coordinate on writing fixes and disclosing

the issue - first to other distros via the distros mailing list and then

eventually publicly via oss-security

the argument as code and the uses of eval replaced with safer parsing

with its own regex based parsing of perl files to look for use directives

interpreter and instead look inside the specified PYTHONPATH manually (to

avoid having the Python interpreter possibly load untrusted shared objects

from that path) - similarly for RUBYLIB

against when looking for interpreted processes to remove the TOCTOU race

regression was introduced in the original update which caused needrestart to

misidentify processes within a container as being on the host and so would

inadvertently kill them

plus preparing and releasing the final updates) liased with upstream to help

get a fix developed and deployed as a regression fix for Ubuntu

filesystem - this is a virtual filesystem managed by the kernel, representing

information about processes in userspace

kernel - and generally file permissions are read-only for these files - so a

process can’t just directly write to them to modify them - BUT these values

all come from the userspace process itself originally

process in question before doing the evaluation as well - although this is

tricky to do correctly - we’ve seen bugs in a number of applications which

try and follow this pattern like snap-confine or apport which turn out to

cause security issues as they don’t drop privileges completely etc

confine it to hopefully limit the damage any other similar bugs may cause

[USN-7117-1] needrestart and Module::ScanDeps vulnerabilities

[USN-7117-2] needrestart regression

Get in contact