CVE-2024-48990

Published Nov 19, 2024

Last updated 6 months ago

Ubuntu

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-48990 is a local privilege escalation vulnerability identified in the `needrestart` utility, affecting versions prior to 3.8. Discovered by Qualys, this flaw allows a local attacker to execute arbitrary code with root privileges. The vulnerability arises when `needrestart` is manipulated into running the Python interpreter while an attacker controls the `PYTHONPATH` environment variable. This manipulation enables the attacker to hijack library paths and execute their own malicious Python code with elevated permissions. The issue has been present since the introduction of interpreter support in `needrestart` version 0.8 in April 2014 and is particularly relevant for Ubuntu Server installations where `needrestart` is installed by default.

Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
Source: security@ubuntu.com
NVD status: Modified
Products: needrestart

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-427

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C03A2810-FF65-4ECC-B74A-0C081E4EC149",
            "versionEndExcluding": "3.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.