Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-gtk | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-ppd | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-atomic | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-compat | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-cpu-partitioning | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-mssql | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-nfv | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-nfv-guest | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-nfv-host | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-openshift | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-oracle | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-postgresql | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-realtime | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-sap | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-sap-hana | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-profiles-spectrumscale | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-utils | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
| Red Hat · RHEL 9 enterprise_linux:9::fastdatapath | tuned-utils-systemtap | 0:2.24.0-2.1.20240819gitc082797f.el9fdp |
Vulnerabilities 2
-
High 7.8
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre…
-
Medium 5.5
Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mi…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0879.json
-
report
https://access.redhat.com/security/cve/CVE-2024-52336
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2324540
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-52336
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52336
-
article
https://github.com/redhat-performance/tuned/releases/tag/v2.24.1
-
article
https://security.opensuse.org/2024/11/26/tuned-instance-create.html
-
article
https://www.openwall.com/lists/oss-security/2024/11/28/1
-
report
https://access.redhat.com/security/cve/CVE-2024-52337
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2324541
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-52337
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52337