A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.

The remote NewStart CGSL host, running version MAIN 7.02, has tuned packages installed that are affected by a vulnerability:

  - A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus     function can be called by locally logged-in users without authentication. This flaw allows a local non-     privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary     scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or     programs could then be executed by Tuned with root privileges that could allow attackers to local     privilege escalation. (CVE-2024-52336)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10384 advisory.

    * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root     (CVE-2024-52336)

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0880 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: improper sanitization of `instance_name` parameter of the     `instance_create()` method (CVE-2024-52337)

    * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root     (CVE-2024-52336)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0879 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: improper sanitization of `instance_name` parameter of the     `instance_create()` method (CVE-2024-52337)

    * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root     (CVE-2024-52336)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tuned installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-52336 advisory.

  - A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus     function can be called by locally logged-in users without authentication. This flaw allows a local non-     privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary     scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or     programs could then be executed by Tuned with root privileges that could allow attackers to local     privilege escalation. (CVE-2024-52336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the tuned-2.24.0-2.el9 build changelog.

  - A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus     function can be called by locally logged-in users without authentication. This flaw allows a local non-     privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary     scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or     programs could then be executed by Tuned with root privileges that could allow attackers to local     privilege escalation. (CVE-2024-52336)

  - A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments.
    This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into     the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the     administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be     the ' character ending the spoofed input, and the administrator can easily overlook this. This logged     string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or     other third-party programs that use Tuned's D-Bus interface for such operations. (CVE-2024-52337)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0cab161b46 advisory.

    This is new version that fixes CVE-2024-52336 and CVE-2024-52337 which allowed privileged execution by     non-privileged active local user and log injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10384 advisory.

    - Fixed privileged execution of arbitrary scripts by active local user,       (CVE-2024-52336)       Resolves: RHEL-66639

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e457d67157 advisory.

    This is new version that fixes CVE-2024-52336 and CVE-2024-52337 which allowed privileged execution by     non-privileged active local user and log injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10384 advisory.

    The tuned packages provide a service that tunes system settings according to a selected profile.

    Security Fix(es):

    * tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root     (CVE-2024-52336)

    * tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method     (CVE-2024-52337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238009	NewStart CGSL MAIN 7.02 : tuned Vulnerability (NS-SA-2025-0073)	Nessus	NewStart CGSL Local Security Checks	high
232935	RockyLinux 9 : tuned (RLSA-2024:10384)	Nessus	Rocky Linux Local Security Checks	high
214917	RHEL 8 : tuned (RHSA-2025:0880)	Nessus	Red Hat Local Security Checks	high
214913	RHEL 9 : tuned (RHSA-2025:0879)	Nessus	Red Hat Local Security Checks	high
213203	CBL Mariner 2.0 Security Update: tuned (CVE-2024-52336)	Nessus	MarinerOS Local Security Checks	high
212093	CentOS 9 : tuned-2.24.0-2.el9	Nessus	CentOS Local Security Checks	high
212067	Fedora 40 : tuned (2024-0cab161b46)	Nessus	Fedora Local Security Checks	high
212038	Oracle Linux 9 : tuned (ELSA-2024-10384)	Nessus	Oracle Linux Local Security Checks	high
211965	Fedora 41 : tuned (2024-e457d67157)	Nessus	Fedora Local Security Checks	high
211878	RHEL 9 : tuned (RHSA-2024:10384)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-52336

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high