CVE-2024-48991

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and trick...

Original description

The description as published by the source.

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-48991 needrestart Fixed in: 3.5-4+deb11u4

References

advisory github.com
advisory nvd.nist.gov
advisory qualys.com
package github.com
patch github.com
patch github.com
report cve.org
web seclists.org
web openwall.com
web lists.debian.org
web openwall.com