CVE-2024-48991
Publication date 19 November 2024
Last updated 22 November 2024
Ubuntu priority
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter).
Read the notes from the security team
Why is this CVE high priority?
Local privilege escalation
Mitigation
Edit /etc/needrestart/needrestart.conf so that the following line appears after "# Disable interpreter scanners." and reboot: $nrconf{interpscan} = 0;
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| needrestart | 24.10 oracular |
Fixed 3.6-8ubuntu4.2
|
| 24.04 LTS noble |
Fixed 3.6-7ubuntu4.3
|
|
| 22.04 LTS jammy |
Fixed 3.5-5ubuntu2.2
|
|
| 20.04 LTS focal |
Fixed 3.4-6ubuntu0.1+esm1
|
|
| 18.04 LTS bionic |
Fixed 3.1-1ubuntu0.1+esm1
|
|
| 16.04 LTS xenial |
Fixed 2.6-1ubuntu0.1~esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
eslerm
The security fix 6ce6136 ("core: prevent race condition on /proc/$PID/exec evaluation") introduces regressions. See upstream issue #317. As of 2024-11-21, no regression fix exists.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7117-1
- needrestart and Module::ScanDeps vulnerabilities
- 19 November 2024