CVE-2024-11003

HIGH

needrestart < 3.8 - Local OS Command Injection via Modules::ScanDeps

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-11003. PoCs published by sychikov, unknown-user-from.

AI-analyzed exploit summary This PoC exploits CVE-2024-11003 in needrestart before version 3.8, where unsanitized input passed to Modules::ScanDeps allows local command execution. The exploit leverages a malicious configuration file to achieve root-level command execution when needrestart is run with sudo.

Description

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Exploits (2)

nomisec WORKING POC

by sychikov · poc

https://github.com/sychikov/CVE-2024-11003-POC

View Code ZIP pw:eip

This PoC exploits CVE-2024-11003 in needrestart before version 3.8, where unsanitized input passed to Modules::ScanDeps allows local command execution. The exploit leverages a malicious configuration file to achieve root-level command execution when needrestart is run with sudo.

Classification

Working Poc 90%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: needrestart < 3.8

Auth required

Prerequisites: sudo access to needrestart · vulnerable version of needrestart installed

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 19, 2026 Full analysis →

nomisec WORKING POC

by unknown-user-from · poc

https://github.com/unknown-user-from/CVE-2024-11003-PoC

View Code ZIP pw:eip

This PoC exploits a vulnerability in needrestart by creating a malicious Perl script and replacing it with a bash binary to gain a shell. The exploit relies on needrestart's handling of executable files.