A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.

The version of tuned installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-52337 advisory.

  - A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments.
    This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into     the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the     administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be     the ' character ending the spoofed input, and the administrator can easily overlook this. This logged     string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or     other third-party programs that use Tuned's D-Bus interface for such operations. (CVE-2024-52337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-11161 advisory.

    - Added sanity checks for API methods parameters, (CVE-2024-52337)       Resolves: RHEL-66614

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:11161 advisory.

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11161 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-10381 advisory.

    [2.11.0-12.0.3]
    - CVE-2024-52337 fixes [Orabug: 37327384]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the tuned-2.24.0-2.el9 build changelog.

  - A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus     function can be called by locally logged-in users without authentication. This flaw allows a local non-     privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary     scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or     programs could then be executed by Tuned with root privileges that could allow attackers to local     privilege escalation. (CVE-2024-52336)

  - A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments.
    This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into     the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the     administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be     the ' character ending the spoofed input, and the administrator can easily overlook this. This logged     string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or     other third-party programs that use Tuned's D-Bus interface for such operations. (CVE-2024-52337)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0cab161b46 advisory.

    This is new version that fixes CVE-2024-52336 and CVE-2024-52337 which allowed privileged execution by     non-privileged active local user and log injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10384 advisory.

    - Fixed privileged execution of arbitrary scripts by active local user,       (CVE-2024-52336)       Resolves: RHEL-66639

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e457d67157 advisory.

    This is new version that fixes CVE-2024-52336 and CVE-2024-52337 which allowed privileged execution by     non-privileged active local user and log injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10381 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10384 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root     (CVE-2024-52336)

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213202	CBL Mariner 2.0 Security Update: tuned (CVE-2024-52337)	Nessus	MarinerOS Local Security Checks	medium
213195	Oracle Linux 8 : tuned (ELSA-2024-11161)	Nessus	Oracle Linux Local Security Checks	medium
213186	AlmaLinux 8 : tuned (ALSA-2024:11161)	Nessus	Alma Linux Local Security Checks	medium
213156	RHEL 8 : tuned (RHSA-2024:11161)	Nessus	Red Hat Local Security Checks	medium
213079	Oracle Linux 7 : tuned (ELSA-2024-10381)	Nessus	Oracle Linux Local Security Checks	medium
212093	CentOS 9 : tuned-2.24.0-2.el9	Nessus	CentOS Local Security Checks	high
212067	Fedora 40 : tuned (2024-0cab161b46)	Nessus	Fedora Local Security Checks	high
212038	Oracle Linux 9 : tuned (ELSA-2024-10384)	Nessus	Oracle Linux Local Security Checks	high
211965	Fedora 41 : tuned (2024-e457d67157)	Nessus	Fedora Local Security Checks	high
211879	RHEL 7 : tuned (RHSA-2024:10381)	Nessus	Red Hat Local Security Checks	medium
211878	RHEL 9 : tuned (RHSA-2024:10384)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-52337

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

high

high

medium

high