linux vulnerability lets hackers run arbitrary python

needsrestart is a program that lets you automatically restart programs that depend on outdate packages. but what if THAT had a bug too? in this video im diving into CVE-2024-48990.

[xoso]

Somewhere in the NSA someone has drawn a line through a word on a whiteboard.

[papakamirneron]

Root: “Is this python?”
User: “Trust me bro.”

[mincraftpolska]

2024 was wild for software vulnerabilities. (and critical bugs too)

[wlockuz]

This is the first time I fully understood a CVE from start to finish.

[bastiman]

Can’t trigger the bug if I dont upgrade my packages🧠

[douro]

Never seen the needrestart screen myself.

[ahjdf]

Still feels weird listening "TV" instead of "learning".

[IngwiePhoenix_nb]

Dude, this might actually genuely help me. We have a few systems at work that can't be rebooted but only give me non-root shells, but have needsrestart. The vendors just refuse to give us - customers - the root shell. With this, I could pop an EOL device's root shell and fix stuff inside out. xD Hahaha, this is amazing. :D

[theohallenius]

It's crazy how most severe and most recent vulnerabilities lately happen to be simple in nature. Makes me wonder what else is hiding out there in plain sight

[flynn]

The fact this vulnerability is specifically targeting python (which is also on almost every Linux installation) makes me wonder if this was intentional or not.

[FreakyRufus]

By the way, the company that published the issue is NOT Quality Software, it is Qualys, a software security company.

[DaVince]

"Would Rust have fixed this?" is not a question that would have ever popped up into my mind, because this bug isn't in the same category as the kind of bugs Rust would protect against.

[kiraaaaaa]

oh wow. that's a _harsh_ reminder that just because it's open source doesn't mean trivial vulns get found quickly

[gordinmitya]

what was in mind of the person who literally wrote “exec(random executable so file) as root”, what could possibly go wrong?

[Ethorbit]

this is why minimal distros are king, just install what you need and nothing more. I've never installed needrestart before.

[todayonthebench]

Interesting security flaw to say the least.
And yes, Rust wouldn't magically fix a flaw like this. A root process carelessly handing over the root permission to a new process without any consideration would be a security flaw regardless of language used.

This however does seem rather serious, but at least it is local.
And to be fair, all root processes should be combed through and searched for basic security flaws like these a bit more thoroughly sometime.

[sasha-febl]

this isn't a linux vulnerability, it's a debian one. how would it be on every linux server if rhel and suse use something totally different?

[luizgrocco]

once again, DON'T TRUST USER INPUT

[syrefaen]

First time I ever heard about 'need restart service', maybe its because I only use desktop linux

[SlyEcho]

“Every Linux”? I’ve only seen it on Ubuntu