PT-2024-8544 · Unknown+3 · Needrestart+3

Mark Esler + 2 · Published 2024-11-17 · Updated 2026-03-07 · CVE-2024-48990

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions needrestart versions prior to 3.8 Module::ScanDeps versions prior to 3.8

Description The needrestart utility, versions prior to 3.8, contains a flaw due to improper handling of the PYTHONPATH environment variable. This allows local attackers to execute arbitrary code with root privileges by manipulating the PYTHONPATH during Python interpreter initialization. The vulnerability stems from an uncontrolled search path element. A publicly available exploit exists for this issue. The vulnerability affects systems running Ubuntu and Debian.

Recommendations Upgrade needrestart to version 3.8 or later. Upgrade Module::ScanDeps to version 3.8 or later.

Exploit

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

ALSA-2025_7350

BDU:2024-10112

CVE-2024-48990

DLA-3957-1

DLA-3957-2

DSA-5815-1

DSA-5815-2

USN-7117-1

USN-7117-2

USN-7117-3

Affected Products

Astra Linux

Linuxmint

Ubuntu

Needrestart

References · 69

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ubuntu_needrestart_lpe.rb · Exploit
• 🔥 https://github.com/makuga01/CVE-2024-48990-PoC · Exploit
• 🔥 https://github.com/pentestfunctions/CVE-2024-48990-PoC-Testing · Exploit
• 🔥 https://github.com/Serner77/CVE-2024-48990-Automatic-Exploit · Exploit
• https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab · Patch
• https://osv.dev/vulnerability/DSA-5815-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48990 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-48990 · Security Note
• https://osv.dev/vulnerability/DSA-5815-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11003 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7117-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48990 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-48990 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-48990 · Vendor Advisory