USN-7117-1: Critical Vulnerabilities in needrestart & Module::ScanDeps

In a series of concerning discoveries by security research team Qualys, critical security faults have been identified in needrestart and the Module::ScanDeps library, which are frequently incorporated in many Linux systems. These vulnerabilities, if exploited, could allow local attackers to execute arbitrary code with root privileges, posing severe security risks to affected systems.

Understanding the Vulnerabilities:

  • CVE-2024-11003: This vulnerability arises from needrestart's practice of passing unsanitized data to libmodule-scandeps-perl, a library that expects safe input. This flaw can potentially be exploited by a local attacker to execute arbitrary code as the root user.
  • CVE-2024-10224: Qualys also revealed that libmodule-scandeps-perl does not correctly parse Perl code, which could allow a local attacker to execute arbitrary shell commands.
  • CVE-2024-48990: Another critical issue was found in how needrestart handles the PYTHONPATH environment variable. Incorrect handling could lead to arbitrary code execution by unintentionally spawning a new Python interpreter with root access.
  • CVE-2024-48991: Additionally, incorrect checking of the path to the Python interpreter by needrestart can allow local attackers to win a race condition, leading to arbitrary code execution as root.
  • CVE-2024-48992: Finally, the misuse of the RUBYLIB environment variable by needrestart to initiate a new Ruby interpreter also presents a similar risk of arbitrary code execution by local attackers.

Impact on System Security:

These vulnerabilities represent a significant threat because they potentially allow attackers who already have local access to escalate their privileges to root. Such elevation can enable attackers to gain full control over the system, manipulate or steal sensitive data, install persistent malware, and perform other malicious activities.

Protective Measures:

  • Immediately apply security updates released in response to these disclosures. Vendors typically provide patches or updated versions of the software that remediate these vulnerabilities.
  • Regularly review and update system and application configurations to enforce strict permission settings and minimize unnecessary exposure of critical environment variables like PYTHONPATH and RUBYLIB.
  • Implement comprehensive monitoring solutions that can detect unusual activities associated with privilege escalation or unauthorized access in real time.

Stay informed about security patches and updates through your software vendors or security advisories. Awareness and prompt action in cybersecurity are crucial in protecting your systems from such severe vulnerabilities.