FKIE_CVE-2024-48991

Vulnerability from fkie_nvd - Published: 2024-11-19 18:15 - Updated: 2026-06-17 07:59
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).
References
security@ubuntu.comhttps://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56dPatch
security@ubuntu.comhttps://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59Patch
security@ubuntu.comhttps://www.cve.org/CVERecord?id=CVE-2024-48991VDB Entry
security@ubuntu.comhttps://www.qualys.com/2024/11/19/needrestart/needrestart.txtThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2024/Nov/17
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/11/30/4Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2024/11/19/1Mailing List
Impacted products
Vendor Product Version
needrestart_project needrestart *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "packageName": "needrestart",
          "platforms": [
            "Linux"
          ],
          "product": "needrestart",
          "repo": "https://github.com/liske/needrestart",
          "vendor": "needrestart",
          "versions": [
            {
              "lessThan": "3.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@ubuntu.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:needrestart_project:needrestart:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "needrestart",
          "vendor": "needrestart_project",
          "versions": [
            {
              "lessThan": "3.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C03A2810-FF65-4ECC-B74A-0C081E4EC149",
              "versionEndExcluding": "3.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system\u0027s real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3)."
    },
    {
      "lang": "es",
      "value": "Qualys descubri\u00f3 que needrestart, antes de la versi\u00f3n 3.8, permite a atacantes locales ejecutar c\u00f3digo arbitrario como superusuario ganando una condici\u00f3n de ejecuci\u00f3n y enga\u00f1ando a needrestart para que ejecute su propio int\u00e9rprete de Python falso (en lugar del int\u00e9rprete de Python real del sistema)."
    }
  ],
  "id": "CVE-2024-48991",
  "lastModified": "2026-06-17T07:59:11.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-48991",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-19T19:36:17.501931Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-19T18:15:21.710",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "VDB Entry"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-48991"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.qualys.com/2024/11/19/needrestart/needrestart.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2024/Nov/17"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/11/30/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2024/11/19/1"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.