{"id":"CVE-2024-48992","aliases":["CLSA-2024-1733429722","CLSA-2024-1734028058","CLSA-2026-1778933429","DEBIAN-CVE-2024-48992","DLA-3957-1","DSA-5815-1","EUVD-2024-43160","GHSA-xmgx-2283-p55h","UBUNTU-CVE-2024-48992","USN-7117-1"],"status":"published","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.07955,"percentile":0.94783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-02T12:03:03Z","fixes":[{"ecosystem":"TuxCare:Ubuntu:18.04","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"needrestart","fixed_in":["3.6-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","fixed_in":["2.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","fixed_in":["3.4-6ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","fixed_in":["3.5-5ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","fixed_in":["3.6-7ubuntu4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-4+deb11u4"}]}],"versions":["3.5-4","3.5-4+deb11u1","3.5-4+deb11u2","3.5-4+deb11u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"],"bundled":5}],"products":[{"vendor":"needrestart","product":"needrestart"},{"vendor":"needrestart_project","product":"needrestart"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48992","tags":["issue-tracking","VDB Entry","report"]},{"url":"https://github.com/liske/needrestart/commit/b5f25f6ec6e7dd0c5be249e4e45de4ee9ffe594f","tags":["patch","Patch","fix"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1","tags":["Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48992","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xmgx-2283-p55h"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1733429722.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1734028058.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778933429.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48992.json","tags":["advisory"]},{"url":"https://github.com/liske/needrestart","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48992","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48992","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7117-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48991","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-48992","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T17:38:22.267Z","modified":"2025-11-03T22:22:13.836Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-43160","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T17:38:22Z","modified":"2025-11-03T22:22:13Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-xmgx-2283-p55h","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T18:31:06Z","modified":"2025-11-04T00:32:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:04:30.667422Z"}],"nvd":[{"id":"CVE-2024-48992","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T18:15:21.897Z","modified":"2026-06-17T07:59:12.013Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-48992","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T17:38:22.267Z","modified":"2026-10-28T02:30:54.038099136Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-48992","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T18:15:21.897Z","modified":"2026-11-02T12:03:03.881480039Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-48992","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.","status":"published","published":"2024-11-19T16:00:00Z","modified":"2026-02-04T02:28:06.434353Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2024-1733429722","title":"Fix CVE(s): CVE-2024-48992","description":"   * SECURITY UPDATE: Arbitrary code execution via manipulated RUBYLIB\n     environment variable\n     - debian/patches/CVE-2024-48992.patch: Prevent script from setting RUBYLIB\n       environment variable to avoid LPE\n     - CVE-2024-48992","status":"published","published":"2024-12-05T20:15:27Z","modified":"2026-06-04T10:04:30.699937Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1734028058","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: Prevent running the Python interpreter with an\n     attacker-controlled PYTHONPATH environment variable\n     - debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set\n       PYTHONPATH environment variable to prevent a LPE and prevent\n       race condition on /proc/$PID/exec evaluation\n     - CVE-2024-48990\n     - CVE-2024-48991\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment\n       variable to prevent a LPE\n     - CVE-2024-48992\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-11003.patch, debian/control: drop usage of\n       Module::ScanDeps to prevent LPE\n     - CVE-2024-11003","status":"published","published":"2024-12-12T18:27:43Z","modified":"2026-06-04T10:03:25.198473Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1778933429","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE\n     - debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE\n     - CVE-2024-11003\n   * SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE\n     - CVE-2024-48990\n   * SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - CVE-2024-48991\n   * SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE\n     - CVE-2024-48992","status":"published","published":"2026-05-16T12:10:34Z","modified":"2026-06-04T10:03:14.157763Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3957-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T01:21:37.79107Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5815-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:09:56.670791Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7117-1","title":"Several security issues were fixed in needrestart and Module::ScanDeps","description":"Qualys discovered that needrestart passed unsanitized data to a library \n(libmodule-scandeps-perl) which expects safe input. A local attacker could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2024-11003)\n\nQualys discovered that the library libmodule-scandeps-perl incorrectly \nparsed perl code. This could allow a local attacker to execute arbitrary\nshell commands. (CVE-2024-10224)\n\nQualys discovered that needrestart incorrectly used the PYTHONPATH \nenvironment variable to spawn a new Python interpreter. A local attacker \ncould possibly use this issue to execute arbitrary code as root. \n(CVE-2024-48990)\n\nQualys discovered that needrestart incorrectly checked the path to the\nPython interpreter. A local attacker could possibly use this issue to win\na race condition and execute arbitrary code as root. (CVE-2024-48991)\n\nQualys discovered that needrestart incorrectly used the RUBYLIB\nenvironment variable to spawn a new Ruby interpreter. A local attacker\ncould possibly use this issue to execute arbitrary code as root.\n(CVE-2024-48992)\n\n","status":"published","published":"2024-11-19T17:54:48Z","modified":"2026-06-25T13:32:30.173916018Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}