Description

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

INFO

Published Date :

2024-11-19T17:38:15.691Z

Last Modified :

2025-11-03T22:22:10.925Z

Source :

canonical
AFFECTED PRODUCTS

The following products are affected by CVE-2024-48991 vulnerability.

Vendors Products
Needrestart Project
  • Needrestart
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-48991.

URL Resource
http://seclists.org/fulldisclosure/2024/Nov/17 cve-icon
http://www.openwall.com/lists/oss-security/2024/11/30/4 cve-icon
https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d cve-icon cve-icon
https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-48991 cve-icon cve-icon
https://www.openwall.com/lists/oss-security/2024/11/19/1 cve-icon
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact