Every CVE Search/ Get API key

CVE-2024-48991

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

7.8 HighFix available

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.07%Up 6.0 points since Nov 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
CVE-2024-48991
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2024-43194 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
EUVD-2024-43194
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4696-66c4-2gvx 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter).

Record
GHSA-4696-66c4-2gvx
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
NVD 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
CVE-2024-48991
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
OSV 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
CVE-2024-48991
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-48991 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
DEBIAN-CVE-2024-48991
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2024-48991 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Record
UBUNTU-CVE-2024-48991
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2024-1733246466 No score

Fix CVE(s): CVE-2024-48991

  • SECURITY UPDATE: Race condition allows local attackers to execute arbitrary code as root
    • debian/patches/CVE-2024-48991.patch: Prevent race condition on /proc/$PID/exec evaluation by synchronizing $exe with the initial value from Proc:ProcessTable
    • CVE-2024-48991
Record
CLSA-2024-1733246466
Updated
2026-11-02
OSVCLSA-2024-1734028058 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: Prevent running the Python interpreter with an attacker-controlled PYTHONPATH environment variable
    • debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set PYTHONPATH environment variable to prevent a LPE and prevent race condition on /proc/$PID/exec evaluation
    • CVE-2024-48990
    • CVE-2024-48991
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-11003.patch, debian/control: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
Record
CLSA-2024-1734028058
Updated
2026-11-02
OSVCLSA-2026-1778933429 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE
    • debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
  • SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE
    • debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE
    • CVE-2024-48990
  • SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • CVE-2024-48991
  • SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
Record
CLSA-2026-1778933429
Updated
2026-11-02
OSVUSN-7117-1 No score

Several security issues were fixed in needrestart and Module::ScanDeps

Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH environment variable to spawn a new Python interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local attacker could possibly use this issue to win a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48992)

Record
USN-7117-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
needrestart
TuxCare:Ubuntu:18.04
 before 3.1-1ubuntu0.1+tuxcare.els3
3.1-1ubuntu0.1+tuxcare.els3
needrestart
TuxCare:Ubuntu:16.04
From an advisory covering 4 CVEs
 before 2.6-1+tuxcare.els1
2.6-1+tuxcare.els1
needrestart
TuxCare:Ubuntu:20.04
From an advisory covering 4 CVEs
 before 3.4-6ubuntu0.1+tuxcare.els1
3.4-6ubuntu0.1+tuxcare.els1
needrestart
Debian:12
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Debian:13
 before 3.7-3.1
3.7-3.1
needrestart
Debian:14
 before 3.7-3.1
3.7-3.1
needrestart
Debian:11
From an advisory covering 4 CVEs
 before 3.5-4+deb11u4, plus listed versions
3.5-43.5-4+deb11u13.5-4+deb11u23.5-4+deb11u3
3.5-4+deb11u4
needrestart
Debian:12
From an advisory covering 4 CVEs
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Ubuntu:Pro:16.04:LTS
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
needrestart
Ubuntu:Pro:20.04:LTS
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
needrestart
Ubuntu:22.04:LTS
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
needrestart
Ubuntu:24.04:LTS
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3
libmodule-scandeps-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 1.20-1ubuntu0.1~esm1, plus listed versions
1.19-11.20-1
1.20-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
libmodule-scandeps-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.23-11.24-1
1.24-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 1.27-1ubuntu0.1~esm1, plus listed versions
1.27-1
1.27-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 1.31-1ubuntu0.1, plus listed versions
1.30-11.31-1
1.31-1ubuntu0.1
needrestart
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
libmodule-scandeps-perl
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 1.35-1ubuntu0.24.04.1, plus listed versions
1.31-21.34-11.35-1
1.35-1ubuntu0.24.04.1
needrestart
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48991 is a high vulnerability (CVSS 7.8) in Needrestart, published November 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.07%, the 93rd percentile. Fixed in needrestart 3.1-1ubuntu0.1+tuxcare.els3.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open