CVE-2024-48992
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
- Affected products
- Astra Linux, Linuxmint, Ubuntu, Needrestart
- Needrestart Project Needrestart
- < 3.8
- Fix
- Available
- CVSS 3.1
- 7.8 HIGH
- EPSS
- 6.6% (93th percentile)
- Weakness
- CWE-427
- NVD status
- Modified
- Published
- 2024-11-19
Workaround
Edit /etc/needrestart/needrestart.conf so that the following line appears after "# Disable interpreter scanners." and reboot: $nrconf{interpscan} = 0;
CVE-2024-48992 at NVD
2 known exploits for CVE-2024-48992
Proof-of-concept code and exploit modules indexed by Sploitus