CVE-2024-58250: PPP Daemon Privilege Escalation Flaw

CVE-2024-58250 Overview

CVE-2024-58250 is a privilege mishandling vulnerability in the passprompt plugin of pppd, the Point-to-Point Protocol daemon maintained by the PPP project. The flaw affects all versions of ppp before 2.5.2. The passprompt plugin invokes an external Password Authentication Protocol (PAP) password prompter program but fails to correctly handle privileges when doing so. Because pppd typically runs with elevated privileges (often setuid root), incorrect privilege handling in a plugin that spawns an external process creates a path for a local attacker to escalate privileges on the host. The issue is tracked under CWE-426: Untrusted Search Path.

Critical Impact

A local attacker can leverage privilege mishandling in the passprompt plugin to execute code with elevated privileges, leading to full compromise of the affected host.

Affected Products

• ppp versions prior to 2.5.2
• The passprompt plugin shipped with pppd
• Linux and Unix-like distributions packaging vulnerable ppp releases

Discovery Timeline

• 2025-04-22 - CVE-2024-58250 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-58250

Vulnerability Analysis

The passprompt plugin is a pppd extension that calls an external helper program to obtain a PAP password from the user. When pppd runs as a privileged process and the plugin executes an external prompter, the plugin must drop privileges or sanitize the execution environment before launching the helper. In affected releases, this privilege handling is incorrect, allowing the spawned process to inherit or be influenced by attacker-controlled execution context. The upstream maintainers chose to remove the plugin entirely rather than refactor it, indicating the risk could not be safely contained within the existing design.

Root Cause

The root cause is improper privilege management combined with reliance on an externally invoked binary, consistent with CWE-426: Untrusted Search Path. The passprompt plugin sources the path to the external prompter from user-influenced configuration, then executes it from within a pppd process that may hold elevated privileges. Without strict privilege separation, the spawned prompter can execute attacker-supplied code in the context of the privileged daemon.

Attack Vector

Exploitation requires local access. An unprivileged user invokes pppd with the passprompt plugin and a prompter path under their control, or otherwise influences the lookup path used by the plugin. The resulting execution occurs with the elevated privileges held by pppd, yielding scope change and full impact to confidentiality, integrity, and availability on the host.

// Upstream fix: removal of passprompt from the build
-pppd_plugin_LTLIBRARIES = minconn.la passprompt.la passwordfd.la winbind.la
+pppd_plugin_LTLIBRARIES = minconn.la passwordfd.la winbind.la
 pppd_plugindir = $(PPPD_PLUGIN_DIR)

 PLUGIN_CPPFLAGS = -I${top_srcdir}

Source: GitHub Commit 0a66ad2

The patch removes passprompt.la from pppd_plugin_LTLIBRARIES in pppd/plugins/Makefile.am and deletes the passprompt.c source file from the tree, eliminating the vulnerable code path entirely.

Detection Methods for CVE-2024-58250

Indicators of Compromise

• Presence of passprompt.so in the pppd plugins directory on hosts running ppp before 2.5.2.
• Invocations of pppd with the plugin passprompt.so directive in command lines or configuration under /etc/ppp/.
• Execution of unexpected child processes spawned by pppd running as root.

Detection Strategies

• Inventory installed ppp packages across Linux endpoints and flag versions below 2.5.2.
• Audit /etc/ppp/options, /etc/ppp/peers/*, and user-supplied pppd arguments for references to the passprompt plugin.
• Monitor process creation telemetry for pppd parent processes spawning prompter binaries from non-standard paths.

Monitoring Recommendations

• Generate alerts when pppd is executed by non-root users with custom plugin paths or external prompter arguments.
• Track package management events that install or upgrade ppp to verify patched versions are deployed.
• Correlate setuid binary execution with subsequent privileged child processes to identify privilege escalation attempts.

How to Mitigate CVE-2024-58250

Immediate Actions Required

• Upgrade ppp to version 2.5.2 or later, which removes the passprompt plugin entirely.
• Remove or disable any remaining passprompt.so files from the pppd plugin directory on patched systems.
• Audit pppd configurations and remove plugin passprompt.so directives from /etc/ppp/ files.

Patch Information

The upstream fix is commit 0a66ad2, included in release 2.5.2. Review the full diff between releases at GitHub Version Comparison 2.5.1 to 2.5.2. The project homepage at PPP Samba Project Homepage tracks supported releases. Linux distribution maintainers have backported the removal into stable package channels — apply vendor security updates promptly.

Workarounds

• If immediate upgrade is not possible, delete passprompt.so from the pppd plugin directory to neutralize the affected code path.
• Remove the setuid bit from /usr/sbin/pppd to prevent unprivileged users from invoking the daemon with elevated privileges, accepting the loss of non-root PPP functionality.
• Restrict execution of pppd to administrators only by tightening file permissions and group membership for the dip or equivalent group.

# Confirm patched ppp version and remove residual passprompt plugin
pppd --version
find / -name 'passprompt.so' -type f 2>/dev/null -delete
grep -RIn 'passprompt' /etc/ppp/ || echo 'No passprompt references found'