CVE-2024-48990

CVE-2024-48990 is an uncontrolled search path flaw (CWE-427) in needrestart, the tool used on Ubuntu and Debian systems to check which services need restarting, affecting all versions before 3.8. A local attacker with low privileges can set the PYTHONPATH environment variable so that when needrestart executes the Python interpreter with root privileges, the attacker's code is loaded and run as root. Successful exploitation yields arbitrary code execution as root, giving the attacker full control of the affected machine. Any server, workstation, or container image running needrestart prior to 3.8 — most notably Ubuntu systems, where the package is shipped and maintained — is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, though EPSS assigns an elevated 20.5% probability of exploitation within 30 days (97th percentile).

What to do: Upgrade needrestart to version 3.8 or later using your distribution's security updates (Ubuntu packages are issued by the Ubuntu security team). Administrators should audit installed systems (e.g., check the needrestart package version) and, as an interim mitigation, restrict local unprivileged access and be cautious running needrestart in environments where users can control environment variables. Given the elevated EPSS score, prioritize patching multi-user servers where local accounts or untrusted code can run.