Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-48990 — Uncontrolled Search Path Element in Needrestart

CWE-427 — Uncontrolled Search Path Element17 documents9 sources
Severity
7.8HIGHNVD
EPSS
15.2%
top 5.37%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
NeedrestartNeedrestart Project NeedrestartDebian Needrestart
Timeline
PublishedNov 19
Latest updateDec 5

Description

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/needrestart< needrestart 3.6-4+deb12u2 (bookworm)
▶CVEListV5needrestart/needrestart< 3.8
▶Debianneedrestart/needrestart< 3.5-4+deb11u4+3
▶Ubuntuneedrestart/needrestart< 3.5-5ubuntu2.3+14

Patches

Patch: github.com ↗

🔴Vulnerability Details

5
OSV
needrestart regression↗2024-12-05
▶
OSV
needrestart regression↗2024-11-26
▶
OSV
Several security issues were fixed in needrestart and Module::ScanDeps↗2024-11-19
▶
OSV
CVE-2024-48990: Qualys discovered that needrestart, before version 3↗2024-11-19
▶
GHSA
GHSA-7c65-3hqv-hvmm: Qualys discovered that needrestart, before version 3↗2024-11-19
▶

💥Exploits & PoCs

1
Metasploit
Ubuntu needrestart Privilege Escalation↗
▶

📋Vendor Advisories

4
Ubuntu
needrestart regression↗2024-12-05
▶
Ubuntu
needrestart regression↗2024-11-26
▶
Ubuntu
needrestart and Module::ScanDeps vulnerabilities↗2024-11-19
▶
Debian
CVE-2024-48990: needrestart - Qualys discovered that needrestart, before version 3.8, allows local attackers t...↗2024
▶

🕵️Threat Intelligence

5
Qualys
Mitigate High-Risk Vulnerabilities Using TruRisk | Qualys↗2024-12-04
▶
Qualys
Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™↗2024-12-04
▶
Bleepingcomputer
Ubuntu Linux impacted by decade-old &#039;needrestart&#039; flaw that gives root↗2024-11-20
▶
Qualys
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart↗2024-11-19
▶
Qualys
Qualys TRU Uncovers 5 Local Privilege Escalation Flaws | Qualys↗2024-11-19
▶

📄Research Papers

1
CTF
easy / README↗
▶
CVE-2024-48990 — Uncontrolled Search Path Element | cvebase