PT-2024-8833 · Tuned+5 · Tuned+5

Matthias Gerstner

·

Published

2024-11-26

·

Updated

2025-03-17

·

CVE-2024-52336

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Tuned (affected versions not specified)
Description: A script injection vulnerability was identified in the Tuned package. The instance create() D-Bus function can be called by locally logged-in users without authentication, allowing a local non-privileged user to execute a D-Bus call with script pre or script post options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges, potentially allowing attackers to perform local privilege escalation.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2024:10384
ALT-PU-2024-16285
AZL-53600
AZL-53696
BDU:2024-10469
CVE-2024-52336
INFSA-2024_10384
OESA-2024-2530
OPENSUSE-SU-2024:14605-1
RHSA-2024:10384
RHSA-2024_10384
RHSA-2025:0879
RHSA-2025:0880
RLSA-2024:10384

Affected Products

Alt Linux
Almalinux
Red Hat
Red Os
Rocky Linux
Tuned