{"id":"CVE-2024-48991","aliases":["CLSA-2024-1733246466","CLSA-2024-1734028058","CLSA-2026-1778933429","DEBIAN-CVE-2024-48991","DLA-3957-1","DSA-5815-1","EUVD-2024-43194","GHSA-4696-66c4-2gvx","UBUNTU-CVE-2024-48991","USN-7117-1"],"status":"published","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.06067,"percentile":0.93487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-02T12:03:04Z","fixes":[{"ecosystem":"TuxCare:Ubuntu:18.04","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"needrestart","fixed_in":["3.6-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","fixed_in":["2.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","fixed_in":["3.4-6ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","fixed_in":["3.5-5ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","fixed_in":["3.6-7ubuntu4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-4+deb11u4"}]}],"versions":["3.5-4","3.5-4+deb11u1","3.5-4+deb11u2","3.5-4+deb11u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"],"bundled":5}],"products":[{"vendor":"needrestart","product":"needrestart"},{"vendor":"needrestart_project","product":"needrestart"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48991","tags":["issue-tracking","VDB Entry","report"]},{"url":"https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59","tags":["patch","Patch","fix"]},{"url":"https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d","tags":["patch","Patch","fix"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/30/4","tags":["Mailing List","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1","tags":["Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48991","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4696-66c4-2gvx"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1733246466.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1734028058.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778933429.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48991.json","tags":["advisory"]},{"url":"https://github.com/liske/needrestart","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48991","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48991","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7117-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7117-2","tags":["advisory"]},{"url":"https://github.com/liske/needrestart/issues/317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-10224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48992","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-48991","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T17:38:15.691Z","modified":"2025-11-03T22:22:10.925Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-43194","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T17:38:15Z","modified":"2025-11-03T22:22:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-4696-66c4-2gvx","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter).","status":"published","published":"2024-11-19T18:31:06Z","modified":"2025-11-04T00:32:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:04:30.667422Z"}],"nvd":[{"id":"CVE-2024-48991","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T18:15:21.71Z","modified":"2026-06-17T07:59:11.903Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-48991","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T17:38:15.691Z","modified":"2026-11-11T10:30:31.596163739Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T11:06:30.165213Z"},{"id":"DEBIAN-CVE-2024-48991","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T18:15:21.71Z","modified":"2026-11-02T12:03:04.019480683Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-48991","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).","status":"published","published":"2024-11-19T16:00:00Z","modified":"2026-02-04T03:11:28.338513Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2024-1733246466","title":"Fix CVE(s): CVE-2024-48991","description":"   * SECURITY UPDATE: Race condition allows local attackers to execute arbitrary\n     code as root\n     - debian/patches/CVE-2024-48991.patch: Prevent race condition on\n       /proc/$PID/exec evaluation by synchronizing $exe with the initial value\n       from Proc:ProcessTable\n     - CVE-2024-48991","status":"published","published":"2024-12-03T17:21:11Z","modified":"2026-06-04T10:03:15.859478Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1734028058","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: Prevent running the Python interpreter with an\n     attacker-controlled PYTHONPATH environment variable\n     - debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set\n       PYTHONPATH environment variable to prevent a LPE and prevent\n       race condition on /proc/$PID/exec evaluation\n     - CVE-2024-48990\n     - CVE-2024-48991\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment\n       variable to prevent a LPE\n     - CVE-2024-48992\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-11003.patch, debian/control: drop usage of\n       Module::ScanDeps to prevent LPE\n     - CVE-2024-11003","status":"published","published":"2024-12-12T18:27:43Z","modified":"2026-06-04T10:03:25.198473Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1778933429","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE\n     - debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE\n     - CVE-2024-11003\n   * SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE\n     - CVE-2024-48990\n   * SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - CVE-2024-48991\n   * SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE\n     - CVE-2024-48992","status":"published","published":"2026-05-16T12:10:34Z","modified":"2026-06-04T10:03:14.157763Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3957-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T01:21:37.79107Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5815-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:09:56.670791Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7117-1","title":"Several security issues were fixed in needrestart and Module::ScanDeps","description":"Qualys discovered that needrestart passed unsanitized data to a library \n(libmodule-scandeps-perl) which expects safe input. A local attacker could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2024-11003)\n\nQualys discovered that the library libmodule-scandeps-perl incorrectly \nparsed perl code. This could allow a local attacker to execute arbitrary\nshell commands. (CVE-2024-10224)\n\nQualys discovered that needrestart incorrectly used the PYTHONPATH \nenvironment variable to spawn a new Python interpreter. A local attacker \ncould possibly use this issue to execute arbitrary code as root. \n(CVE-2024-48990)\n\nQualys discovered that needrestart incorrectly checked the path to the\nPython interpreter. A local attacker could possibly use this issue to win\na race condition and execute arbitrary code as root. (CVE-2024-48991)\n\nQualys discovered that needrestart incorrectly used the RUBYLIB\nenvironment variable to spawn a new Ruby interpreter. A local attacker\ncould possibly use this issue to execute arbitrary code as root.\n(CVE-2024-48992)\n\n","status":"published","published":"2024-11-19T17:54:48Z","modified":"2026-06-25T13:32:30.173916018Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}