Every CVE Search/ Get API key

CVE-2024-48992

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

7.8 HighFix available

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

7.95%Up 7.9 points since Nov 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
CVE-2024-48992
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
EUVDEUVD-2024-43160 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
EUVD-2024-43160
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xmgx-2283-p55h 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
GHSA-xmgx-2283-p55h
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
NVD 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
CVE-2024-48992
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
OSV 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
CVE-2024-48992
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-48992 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
DEBIAN-CVE-2024-48992
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2024-48992 7.8

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.

Record
UBUNTU-CVE-2024-48992
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2024-1733429722 No score

Fix CVE(s): CVE-2024-48992

  • SECURITY UPDATE: Arbitrary code execution via manipulated RUBYLIB environment variable
    • debian/patches/CVE-2024-48992.patch: Prevent script from setting RUBYLIB environment variable to avoid LPE
    • CVE-2024-48992
Record
CLSA-2024-1733429722
Updated
2026-11-02
OSVCLSA-2024-1734028058 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: Prevent running the Python interpreter with an attacker-controlled PYTHONPATH environment variable
    • debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set PYTHONPATH environment variable to prevent a LPE and prevent race condition on /proc/$PID/exec evaluation
    • CVE-2024-48990
    • CVE-2024-48991
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-11003.patch, debian/control: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
Record
CLSA-2024-1734028058
Updated
2026-11-02
OSVCLSA-2026-1778933429 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE
    • debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
  • SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE
    • debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE
    • CVE-2024-48990
  • SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • CVE-2024-48991
  • SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
Record
CLSA-2026-1778933429
Updated
2026-11-02
OSVUSN-7117-1 No score

Several security issues were fixed in needrestart and Module::ScanDeps

Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH environment variable to spawn a new Python interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local attacker could possibly use this issue to win a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48992)

Record
USN-7117-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
needrestart
TuxCare:Ubuntu:18.04
 before 3.1-1ubuntu0.1+tuxcare.els4
3.1-1ubuntu0.1+tuxcare.els4
needrestart
TuxCare:Ubuntu:16.04
From an advisory covering 4 CVEs
 before 2.6-1+tuxcare.els1
2.6-1+tuxcare.els1
needrestart
TuxCare:Ubuntu:20.04
From an advisory covering 4 CVEs
 before 3.4-6ubuntu0.1+tuxcare.els1
3.4-6ubuntu0.1+tuxcare.els1
needrestart
Debian:12
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Debian:13
 before 3.7-3.1
3.7-3.1
needrestart
Debian:14
 before 3.7-3.1
3.7-3.1
needrestart
Debian:11
From an advisory covering 4 CVEs
 before 3.5-4+deb11u4, plus listed versions
3.5-43.5-4+deb11u13.5-4+deb11u23.5-4+deb11u3
3.5-4+deb11u4
needrestart
Debian:12
From an advisory covering 4 CVEs
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Ubuntu:Pro:16.04:LTS
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
needrestart
Ubuntu:Pro:20.04:LTS
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
needrestart
Ubuntu:22.04:LTS
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
needrestart
Ubuntu:24.04:LTS
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3
libmodule-scandeps-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 1.20-1ubuntu0.1~esm1, plus listed versions
1.19-11.20-1
1.20-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
libmodule-scandeps-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.23-11.24-1
1.24-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 1.27-1ubuntu0.1~esm1, plus listed versions
1.27-1
1.27-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 1.31-1ubuntu0.1, plus listed versions
1.30-11.31-1
1.31-1ubuntu0.1
needrestart
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
libmodule-scandeps-perl
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 1.35-1ubuntu0.24.04.1, plus listed versions
1.31-21.34-11.35-1
1.35-1ubuntu0.24.04.1
needrestart
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48992 is a high vulnerability (CVSS 7.8) in Needrestart, published November 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.95%, the 94th percentile. Fixed in needrestart 3.1-1ubuntu0.1+tuxcare.els4.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open