← Vulnerability feed

Vulnerability record · CVE-2024-48991 · published 19 November 2024

CVE-2024-48991: Needrestart project needrestart race condition vulnerability

NNeedrestart Project · Needrestart

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

7.8 CVSS 3.1 High EPSS 6.1% · top 6.9% CWE-362 · Race condition
7.8CVSS 3.1 base score
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d Patch
https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 Patch
https://www.cve.org/CVERecord?id=CVE-2024-48991 VDB Entry
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Third Party Advisory
http://seclists.org/fulldisclosure/2024/Nov/17
http://www.openwall.com/lists/oss-security/2024/11/30/4 Mailing List
https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
https://www.openwall.com/lists/oss-security/2024/11/19/1 Mailing List

Track CVE-2024-48991 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2024-48990Needrestart project needrestart uncontrolled search path element vulnerabilityQualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running…EPSS 20%7.8CVE-2024-48992Needrestart project needrestart uncontrolled search path element vulnerabilityQualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running…EPSS 7.6%7.8CVE-2024-11003Needrestart project needrestart os command injection vulnerabilityQualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could…EPSS 11%7.8CVE-2022-30688Needrestart project needrestart vulnerabilityneedrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anch…EPSS 0.41%5.5CVE-2025-39964Linux kernel af_alg race condition allows concurrent socket writesThe Linux kernel's af_alg crypto socket implementation did not prevent two concurrent writes to the same socket, allowing data to be interleaved unpr…KEVEPSS 1.00%analysed7.0CVE-2025-62215Windows Kernel race condition and double free privilege escalationA race condition combined with a double free in the Windows Kernel lets a locally authenticated attacker corrupt kernel memory and elevate privileges…KEVEPSS 6.0%analysed7.5CVE-2023-36884Microsoft Windows Search race condition allows remote code executionCVE-2023-36884 is a race condition (CWE-362) in Microsoft Windows Search that permits remote code execution. It affects a broad set of Windows 10, Wi…KEVEPSS 99%analysed6.4CVE-2021-25395Samsung Android MFC charger driver race condition bypasses signature checkA race condition in the Samsung MFC charger driver, fixed prior to SMR MAY-2021 Release 1, lets a local attacker bypass a signature check. It matters…KEVEPSS 0.37%analysed

Source: NIST National Vulnerability Database (record CVE-2024-48991), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.