CVE-2024-11003 Command injection in needrestart
A local attacker can execute arbitrary shell commands via unsanitized data passed to a library in needrestart, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-11003?
CVE-2024-11003 is a high-severity command injection vulnerability in needrestart, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.
Weakness: CWE-78
Which versions are affected by CVE-2024-11003?
It affects 1 product.
Products include Needrestart Project Needrestart.
How do I fix CVE-2024-11003?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-11003 being exploited?
There is no known exploitation of CVE-2024-11003 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in needrestart
Sources
Also known as DEBIAN-CVE-2024-11003, GHSA-9f4h-r2c7-m6w4, UBUNTU-CVE-2024-11003.