A vulnerability in tuned that allows executing code with root privileges
A vulnerability (CVE-2024-52336) has been identified in the tuned background service developed by Red Hat, which performs automatic optimization of hardware and kernel settings based on current load, allowing a local unprivileged user to execute any commands with root privileges. The issue exists in the implementation of the DBus method 'com.redhat.tuned.instance_create', used for creating plugin instances, where parameters 'script_pre' and 'script_post' can be passed to specify scripts, […]
