CVE-2024-48991

Katalog CVE

CVSS 7.8 · High EPSS 6,0%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada needrestart project needrestart. Skor CVSS 3.1 7.8 (High) menurut ubuntu.com.

Deskripsi (NVD)

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

Rincian

Terbit di NVD

19 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

6,0% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d patch
• https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 patch
• https://www.qualys.com/2024/11/19/needrestart/needrestart.txt advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2024-48991 vdb entry
• http://seclists.org/fulldisclosure/2024/Nov/17
• http://www.openwall.com/lists/oss-security/2024/11/30/4 mailing list
• https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
• https://www.openwall.com/lists/oss-security/2024/11/19/1 mailing list