CVE-2024-52336
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-52336
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52336.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-52336
- Related
- Published
- 2024-11-26T16:15:17Z
- Modified
- 2025-02-03T21:47:35.523457Z
- Summary
- [none]
- Details
-
A script injection vulnerability was identified in the Tuned package. The
instance_create()D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call withscript_preorscript_postoptions that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation. - References
-
- https://access.redhat.com/errata/RHSA-2024:10384
- https://access.redhat.com/errata/RHSA-2025:0879
- https://access.redhat.com/errata/RHSA-2025:0880
- https://bugzilla.redhat.com/show_bug.cgi?id=2324540
- https://access.redhat.com/security/cve/CVE-2024-52336
- https://security.opensuse.org/2024/11/26/tuned-instance-create.html
- https://www.openwall.com/lists/oss-security/2024/11/28/1
- https://www.openwall.com/lists/oss-security/2024/11/28/2
- https://security-tracker.debian.org/tracker/CVE-2024-52336
Affected packages
Debian:13 / tuned
Package
- Name
- tuned
- Purl
- pkg:deb/debian/tuned?arch=source