Every CVE Search/ Get API key

CVE-2024-48990

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

7.8 HighPublic exploitFix available

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

21.3%Up 21.2 points since Nov 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
CVE-2024-48990
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
EUVDEUVD-2024-43193 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
EUVD-2024-43193
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-7c65-3hqv-hvmm 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
GHSA-7c65-3hqv-hvmm
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
NVD 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
CVE-2024-48990
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
OSV 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
CVE-2024-48990
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-48990 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
DEBIAN-CVE-2024-48990
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-48990 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Record
UBUNTU-CVE-2024-48990
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2024-1734028058 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: Prevent running the Python interpreter with an attacker-controlled PYTHONPATH environment variable
    • debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set PYTHONPATH environment variable to prevent a LPE and prevent race condition on /proc/$PID/exec evaluation
    • CVE-2024-48990
    • CVE-2024-48991
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-11003.patch, debian/control: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
Record
CLSA-2024-1734028058
Updated
2026-11-02
OSVCLSA-2026-1778933429 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE
    • debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
  • SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE
    • debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE
    • CVE-2024-48990
  • SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • CVE-2024-48991
  • SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
Record
CLSA-2026-1778933429
Updated
2026-11-02
OSVUSN-7117-1 No score

Several security issues were fixed in needrestart and Module::ScanDeps

Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH environment variable to spawn a new Python interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local attacker could possibly use this issue to win a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48992)

Record
USN-7117-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
needrestart
TuxCare:Ubuntu:16.04
From an advisory covering 4 CVEs
 before 2.6-1+tuxcare.els1
2.6-1+tuxcare.els1
needrestart
TuxCare:Ubuntu:20.04
From an advisory covering 4 CVEs
 before 3.4-6ubuntu0.1+tuxcare.els1
3.4-6ubuntu0.1+tuxcare.els1
needrestart
Debian:12
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Debian:13
 before 3.7-3.1
3.7-3.1
needrestart
Debian:14
 before 3.7-3.1
3.7-3.1
needrestart
Debian:11
From an advisory covering 4 CVEs
 before 3.5-4+deb11u4, plus listed versions
3.5-43.5-4+deb11u13.5-4+deb11u23.5-4+deb11u3
3.5-4+deb11u4
needrestart
Debian:12
From an advisory covering 4 CVEs
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Ubuntu:Pro:16.04:LTS
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
needrestart
Ubuntu:Pro:20.04:LTS
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
needrestart
Ubuntu:22.04:LTS
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
needrestart
Ubuntu:24.04:LTS
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3
libmodule-scandeps-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 1.20-1ubuntu0.1~esm1, plus listed versions
1.19-11.20-1
1.20-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
libmodule-scandeps-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.23-11.24-1
1.24-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 1.27-1ubuntu0.1~esm1, plus listed versions
1.27-1
1.27-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 1.31-1ubuntu0.1, plus listed versions
1.30-11.31-1
1.31-1ubuntu0.1
needrestart
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
libmodule-scandeps-perl
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 1.35-1ubuntu0.24.04.1, plus listed versions
1.31-21.34-11.35-1
1.35-1ubuntu0.24.04.1
needrestart
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitUbuntu needrestart Privilege Escalation2024-11-19
PoC in GitHubmakuga01/CVE-2024-48990-PoC2024-11-20
PoC in GitHubns989/CVE-2024-489902024-11-21
PoC in GitHubfelmoltor/CVE-2024-489902024-11-22
PoC in GitHubCyb3rFr0g/CVE-2024-48990-PoC2024-11-24
PoC in GitHubpentestfunctions/CVE-2024-48990-PoC-Testing2024-11-24
PoC in GitHubally-petitt/CVE-2024-48990-Exploit2024-11-25
PoC in GitHubCyberCrowCC/CVE-2024-489902024-12-09
PoC in GitHubNullByte-7w7/CVE-2024-489902024-12-18
PoC in GitHubSerner77/CVE-2024-48990-Automatic-Exploit2025-10-28
Show 10 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubmladicstefan/CVE-2024-489902025-10-28
PoC in GitHubMr-DJ/CVE-2024-489902025-10-30
PoC in GitHubLoaxert/CVE-2024-48990-PoC2025-10-31
PoC in GitHubendermixxer/CVE-2024-48990_needrestart2025-11-11
PoC in GitHubnekr0ff/needrestart-sudo-escalate-cve-2024-489902025-11-12
PoC in GitHub0x3bs/CVE-2024-489902025-12-01
PoC in GitHubo-sec/CVE-2024-489902025-12-16
PoC in GitHubsobbing333/CVE-2024-48990-POC2025-12-21
PoC in GitHubgrecosamuel/CVE-2024-489902025-12-22
PoC in GitHubBLUEBERRYP1LL/CVE-2024-489902026-02-13

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48990 is a high vulnerability (CVSS 7.8) in Needrestart, published November 19, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.3%, the 97th percentile. Fixed in needrestart 3.6-4+deb12u2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open