CVE-2024-48991: Race Condition
Last updated 22 November 2024
Other sources
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter).
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/needrestartto a version that resolves this vulnerability.Fixed in 3.6-4+deb12u3Fixed in 3.11-1 - Upgrade
Upgrade
debian/needrestartto a version that resolves this vulnerability.Fixed in 3.6-4+deb12u2 - Upgrade
Upgrade
debian/needrestartto a version that resolves this vulnerability.Fixed in 3.7-3.1 - Configuration
Edit /etc/needrestart/needrestart.conf and set $nrconf{interpscan} = 0; after the '# Disable interpreter scanners.' comment.
needrestart $nrconf{interpscan} = 0 - Operational
Reboot the system after changing the needrestart configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48991?
CVE-2024-48991 is considered a critical vulnerability due to its potential to allow local attackers to execute arbitrary code as root.
How do I fix CVE-2024-48991?
To fix CVE-2024-48991, upgrade needrestart to version 3.8 or later.
What versions of needrestart are affected by CVE-2024-48991?
Versions of needrestart prior to 3.8, specifically those up to 3.5-4+deb11u3, 3.6-4+deb12u1, and 3.7-3.1 are affected by CVE-2024-48991.
Who discovered CVE-2024-48991?
CVE-2024-48991 was discovered by Qualys.
What type of attacks can CVE-2024-48991 facilitate?
CVE-2024-48991 can facilitate local privilege escalation attacks through a race condition.