CVE-2024-48991

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48991
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d Patch
https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 Patch
https://www.cve.org/CVERecord?id=CVE-2024-48991 VDB Entry
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/11/30/4 Mailing List
https://www.openwall.com/lists/oss-security/2024/11/19/1 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:*
History

03 Jul 2025, 16:08

Type Values Removed Values Added
CPE cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:*
First Time Needrestart Project
Needrestart Project needrestart
References () https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d - () https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d - Patch
References () https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 - () https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 - Patch
References () https://www.cve.org/CVERecord?id=CVE-2024-48991 - () https://www.cve.org/CVERecord?id=CVE-2024-48991 - VDB Entry
References () https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - () https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/11/30/4 - () http://www.openwall.com/lists/oss-security/2024/11/30/4 - Mailing List
References () https://www.openwall.com/lists/oss-security/2024/11/19/1 - () https://www.openwall.com/lists/oss-security/2024/11/19/1 - Mailing List

13 Mar 2025, 16:15

Type Values Removed Values Added
CWE CWE-362

03 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://www.openwall.com/lists/oss-security/2024/11/19/1 -

30 Nov 2024, 13:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/11/30/4 -

26 Nov 2024, 21:15

Type Values Removed Values Added
References
  • () https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d -
Summary
  • (es) Qualys descubrió que needrestart, antes de la versión 3.8, permite a atacantes locales ejecutar código arbitrario como superusuario ganando una condición de ejecución y engañando a needrestart para que ejecute su propio intérprete de Python falso (en lugar del intérprete de Python real del sistema).
Summary (en) Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). (en) Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

19 Nov 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-19 18:15

Updated : 2025-07-03 16:08

NVD link : CVE-2024-48991

Mitre link : CVE-2024-48991

CVE.ORG link : CVE-2024-48991

JSON object : View

Products Affected

needrestart_project

  • needrestart
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')