Qualys TRU Uncovers 5 Local Privilege Escalation Flaws | Qualys
Summary: The Qualys Threat Research Unit identified five Local Privilege Escalation vulnerabilities in needrestart, a component installed by default on Ubuntu Server since version 21.04, tracked as CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003. The flaws, present since interpreter support was added in needrestart version 0.8 in April 2014, let any unprivileged user execute arbitrary code as root by manipulating an attacker-controlled environment variable, and Qualys says it developed functional exploits for all five.
Why it matters: Any local user on an affected Ubuntu Server can reach root without user interaction, and needrestart runs automatically after APT operations including unattended upgrades - so the vulnerable code path is exercised on a routine schedule across a substantial number of deployments globally. Qualys warns other researchers may release working exploits shortly after this coordinated disclosure.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-10224CVE-2024-11003CVE-2024-48990CVE-2024-48991CVE-2024-48992
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026