Description
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | tuned | 2.23.0 – < 2.24.1 | 2.24.1 |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Fast Datapath for RHEL 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tuned | 2.24.1-1 | — |
| Debian 13 | tuned | 2.24.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tuned | No fix yet | — |
| Ubuntu 26.04 LTS | tuned | No fix yet | — |
| Ubuntu 25.10 | tuned | No fix yet | — |
| Ubuntu 24.04 LTS | tuned | No fix yet | — |
| Ubuntu 22.04 LTS | tuned | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | tuned | No fix yet | — |
| Ubuntu 18.04 LTS | tuned | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | tuned +15 | 2.24.0-2.el9_5 | RHSA-2025:0879, RHSA-2024:10384 |
| RHEL 9 | tuned-profiles-compat +2 | 2.24.0-2.1.20240819gitc082797f.el9fdp | RHSA-2025:0879 |
| RHEL 8 | tuned +18 | 2.24.0-2.1.20240819gitc082797f.el8fdp | RHSA-2025:0880 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | tuned +10 | 2.24.0-2.el9_5.alma.1 | ALSA-2024:10384 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | tuned | 2.24.0-2.el9_5 | RLSA-2024:10384 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tuned | 2.24.1.0+git.90c24ee-1.1 | openSUSE-SU-2024:14605-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tuned | 2.21.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | tuned | 2.15.0-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | tuned +11 | 2.24.0-2.0.1.el9_5 | ELSA-2024-10384 |
Advisories 8
- ALSA-2024:10384 Important: tuned security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0879 Red Hat Security Advisory: tuned security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:0880 Red Hat Security Advisory: tuned security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:10384 Red Hat Security Advisory: tuned security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RLSA-2024:10384 Important: tuned security update Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2024:14605-1 tuned-2.24.1.0+git.90c24ee-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3551 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 24, 2025
- ELSA-2024-10384 Important: tuned security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 29, 2024
References
- RHSA-2024:10384 vendor-advisory
- RHSA-2025:0879 vendor-advisory
- RHSA-2025:0880 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-52336 vdb-entry
- RHBZ#2324540 issue-tracking
- https://github.com/redhat-performance/tuned/releases/tag/v2.24.1
- https://security.opensuse.org/2024/11/26/tuned-instance-create.html
- https://www.openwall.com/lists/oss-security/2024/11/28/1