Linux Privilege Escalation via PYTHONPATH Manipulation

This threat involves local privilege escalation on Linux systems where attackers exploit the way Python handles module loading. By manipulating the PYTHONPATH environment variable, an adversary can influence a privileged process to import a malicious shared object instead of the legitimate library. This technique is specifically documented in the exploitation of CVE-2024-48990, a vulnerability in the 'NeedRestart' utility which checks for pending service restarts on Linux distributions. When NeedRestart runs with root privileges, it can be coerced into loading a crafted 'importlib/init.so' file placed in an attacker-controlled directory. If successful, the attacker gains arbitrary code execution with the permissions of the calling process, typically root. Defenders should monitor for the creation of shared object files with specific naming conventions in non-standard system directories.

Attack Chain

1. Attacker gains low-privileged access to the target Linux system.
2. Attacker identifies the use of the NeedRestart utility (CVE-2024-48990) or similar vulnerable processes.
3. Attacker creates a malicious shared object file named 'importlib/init.so'.
4. Attacker writes this malicious library to an attacker-controlled directory outside of standard system paths (e.g., /tmp or user home directories).
5. Attacker sets or modifies the PYTHONPATH environment variable to include the directory containing the malicious library.
6. Attacker triggers the execution of the privileged NeedRestart utility.
7. The utility, due to the manipulated PYTHONPATH, loads the attacker's 'importlib/init.so' module instead of the legitimate one.
8. The malicious code within the shared object executes with root privileges, leading to full system compromise.

Impact

Successful exploitation of this technique results in full local privilege escalation to the root user. This allows an attacker to bypass standard security controls, access sensitive system data, install persistent backdoors, and execute arbitrary commands across the affected Linux environment.

Recommendation

1. Deploy the provided Sigma detection rule to monitor for unauthorized 'importlib/init.so' file creation events.
2. Patch the NeedRestart utility immediately to remediate CVE-2024-48990 on all vulnerable Linux endpoints.
3. Audit environment variable configurations for high-privileged service accounts to ensure PYTHONPATH is not overly permissive.
4. Enable Sysmon for Linux Event ID 11 logging to capture filesystem creation events required for the detection logic.