CVE-2024-58250: The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges

What it is

CVE-2024-58250, a privilege-escalation flaw in the passprompt.so plugin of the PPP project's pppd daemon, affecting PPP version 2.5.1 and older. The CVE was published 22/04/2025; the fix landed 25/10/2024 and shipped in PPP 2.5.2 (released 31/12/2024). On distributions like Debian, pppd is installed setUID root, so it begins execution as root before dropping privileges.

How it works

pppd relinquishes root using the set*id() family. But passprompt.c (in promptpass(), before execv) drops privileges only with seteuid(getuid()) and setegid(getgid()) — the effective IDs. Because the real/saved IDs still hold root, the drop is not permanent: code running after these calls can regain root by calling setuid(0) / setgid(0). The plugin then execvs promptprog, a path the attacker can supply on the command line:

/usr/sbin/pppd plugin passprompt.so promptprog /tmp/rogue call <peer>

Where /tmp/rogue contains:

setuid(0);
setgid(0);

Preconditions / Affected

Several conditions must converge, which is why the author disputes the "critical" rating:

• pppd must be setUID root (not the default startup on the distributions mentioned).
• The passprompt.so plugin must be in use, and only privileged users can request it.
• The attacker must control the promptprog path (e.g. /tmp/rogue) or have a code-execution bug in the plugin itself.

flowchart TD
  A[setUID root pppd] --> B{passprompt.so loaded?}
  B -->|no| X[not exploitable]
  B -->|yes| C{attacker controls promptprog<br/>or has code-exec in plugin?}
  C -->|no| X
  C -->|yes| D[seteuid/setegid drop<br/>effective IDs only]
  D --> E[injected setuid 0 / setgid 0<br/>regains root]

What to do

Upgrade to PPP 2.5.2 or later. The upstream fix did not patch the privilege logic — it removed passprompt.so entirely, the code being deemed too old (fix commit on GitHub). Debian, Gentoo and Fedora coordinated the fix.

Caveats

The author (who reported the issue) states the preconditions are numerous and unlikely in default configurations, and says they would not have rated the CVE as high as "critical" — the severity reflects potential impact, not ease of triggering. Testing was done on Debian; other distributions' setUID and default-startup behavior may differ.