Log in Start free

Vulnerability · Published Nov 26, 2024 · Assigned by redhat

CVE-2024-52336Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

High 7.8

In plain English

A high-severity privilege mismanagement in tuned. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9tuned2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-gtk2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-ppd2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-atomic2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-cpu-partitioning2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-mssql2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-oracle2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-postgresql2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-realtime2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-profiles-spectrumscale2.24.0-2.el9_5.alma.1ALSA-2024:10384
AlmaLinux:9tuned-utils2.24.0-2.el9_5.alma.1ALSA-2024:10384
Debian:13tuned2.24.1-1DEBIAN-CVE-2024-52336
Debian:14tuned2.24.1-1DEBIAN-CVE-2024-52336
Rocky Linux:9tuned0:2.24.0-2.el9_5RLSA-2024:10384
Ubuntu:22.04:LTStunedno fix listedUBUNTU-CVE-2024-52336
Ubuntu:24.04:LTStunedno fix listedUBUNTU-CVE-2024-52336
Ubuntu:25.10tunedno fix listedUBUNTU-CVE-2024-52336
Ubuntu:26.04:LTStunedno fix listedUBUNTU-CVE-2024-52336
Ubuntu:26.10tunedno fix listedUBUNTU-CVE-2024-52336

Affected products (as reported)

VendorProductVersions
tuned 2.23.0 – before 2.24.1
Red Hat Fast Datapath for Red Hat Enterprise Linux 8 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References