This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Needrestart fixes 4 high-severity vulnerabilities

needrestart version 3.8 fixes 4 high-severity vulnerabilities. Needrestart is a tool that detects which services need to be restarted (usually after an update). In the default configuration, this tool is available on all Ubuntu Server instances since version 21.04, but the vulnerabilities also affect other Linux distributions where it can be installed additionally [1]. Further details about these vulnerabilities can be found at [1]. A command to check whether your machine is vulnerable and options for a temporary workaround can be found at [2]. Individual Linux distributions and their fixed versions: Ubuntu [2]: Oracular - 3.6-8ubuntu4 Noble - 3.6-7ubuntu4.1 Jammy - 3.5-5ubuntu2.1 Focal - 3.4-6ubuntu0.1 Bionic - 3.1-1ubuntu0.1 Xenial - 2.6-1 Debian: bullseye (security) - 3.5-4+deb11u4 [3] bookworm (security) - 3.6-4+deb12u2 [4]

needrestart - RCE (CVE-2024-48990, CVE-2024-48992)
CVSS 7.8 (High)

An authenticated local attacker can execute arbitrary Python or Ruby code with root privileges, provided they can set the PYTHONPATH or RUBYLIB environment variable [1][5][6].

The vulnerability is present in product:

  • needrestart; <3.8;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 19. 11. 2024.

needrestart - RCE (CVE-2024-48991)
CVSS 7.8 (High)

Allows an authenticated local attacker to execute arbitrary Python code with root privileges by spoofing the path to the Python interpreter. Exploiting the vulnerability requires winning a TOCTOU race condition, for which, however, a reliable method is known. It can be assumed that this vulnerability also affects the Ruby interpreter, but this information has not yet been verified [1][7].

The vulnerability is present in product:

  • needrestart; <3.8;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 19. 11. 2024.

needrestart - command execution (CVE-2024-11003)
CVSS 7.8 (High)

Allows an authenticated local attacker to execute arbitrary operating system commands with root privileges on the affected machine using a specially crafted Perl source file name [1][8].

The vulnerability is present in product:

  • needrestart; <3.8;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-11003 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 19. 11. 2024.

By CESNET, z.s.p.o. Martin Krajči on 20. 11. 2024.

CESNET, z.s.p.o. Logo