CVE-2024-48991
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).
- Affected products
- Astra Linux, Linuxmint, Ubuntu, Needrestart
- Needrestart Project Needrestart
- < 3.8
- Fix
- Available
- CVSS 3.1
- 7.8 HIGH
- EPSS
- 5.3% (92th percentile)
- Weakness
- CWE-362
- NVD status
- Modified
- Published
- 2024-11-19
Workaround
Edit /etc/needrestart/needrestart.conf so that the following line appears after "# Disable interpreter scanners." and reboot: $nrconf{interpscan} = 0;
CVE-2024-48991 at NVD
2 known exploits for CVE-2024-48991
Proof-of-concept code and exploit modules indexed by Sploitus