CVE-2024-48992
📋 TL;DR
CVE-2024-48992 is a local privilege escalation vulnerability in needrestart versions before 3.8. Attackers with local access can trick needrestart into executing arbitrary code as root by manipulating the RUBYLIB environment variable. This affects systems running vulnerable versions of needrestart, commonly found on Debian, Ubuntu, and other Linux distributions.
💻 Affected Systems
- needrestart
📦 What is this software?
Needrestart by Needrestart Project
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges, enabling complete system compromise, data theft, persistence establishment, and lateral movement.
Likely Case
Privileged user or attacker with initial foothold escalates to root to install malware, modify system configurations, or access sensitive data.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated systems with quick detection and containment.
🎯 Exploit Status
Exploit requires local access but is straightforward to execute. Technical details and proof-of-concept are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8 and later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
Restart Required: No
Instructions:
1. Update needrestart to version 3.8 or later using your package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install needrestart. 3. Verify installation with: needrestart --version.
🔧 Temporary Workarounds
Remove RUBYLIB environment variable
linuxPrevent exploitation by clearing or restricting RUBYLIB environment variable for needrestart processes
sudo systemctl edit needrestart.service
Add: Environment="RUBYLIB="
sudo systemctl daemon-reload
sudo systemctl restart needrestart
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable needrestart versions
- Implement strict monitoring for unusual process execution or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check needrestart version with: needrestart --version. If version is below 3.8, system is vulnerable.Check Version:
needrestart --versionVerify Fix Applied:
After update, run: needrestart --version. Confirm version is 3.8 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual needrestart process execution with RUBYLIB environment variable
- Privilege escalation attempts via needrestart
Network Indicators:
- None - this is a local attack
SIEM Query:
process.name:"needrestart" AND process.env:RUBYLIB=*🔗 References
- https://github.com/liske/needrestart/commit/b5f25f6ec6e7dd0c5be249e4e45de4ee9ffe594f
- https://www.cve.org/CVERecord?id=CVE-2024-48992
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
- http://seclists.org/fulldisclosure/2024/Nov/17
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
- https://www.openwall.com/lists/oss-security/2024/11/19/1
