A vulnerability (CVE-2024-52336) has been identified in the background process tuned, developed by Red Hat, which performs automatic optimization of hardware and kernel settings based on current load, allowing a local unprivileged user to execute any commands with root privileges.
The issue exists in the implementation of the DBus method 'com.redhat.tuned.instance_create', used to create plugin instances, where parameters 'script_pre' and 'script_post' can be passed to specify scripts executed before or after creating the plugin instance. The problem is that Polkit settings allow any authenticated local user to send a DBus request to this method without authentication, while the tuned process itself runs with root privileges and executes the scripts specified in the 'script_pre' and 'script_post' parameters also with root privileges. For example, to run the script /path/to/myscript.sh with root privileges, the user only needs to execute the command: gdbus call -y -d com.redhat.tuned -o /Tuned -m com.redhat.tuned.control.instance_create cpu myinstance '{"script_pre": "/path/to/myscript.sh", "devices": "*"}'
There is also a less critical vulnerability (CVE-2024-52337) in the DBus method 'com.redhat.tuned.instance_create', caused by the lack of sanitization of the instance plugin name value when logging. An attacker can include a name containing newlines and escape characters for the terminal emulator, which can be used to disrupt the log structure and perform actions when displaying the output of the 'tuned-adm get_instances' command in the terminal. EVIL=`echo -e "this is\nevil\033[?1047h"` gdbus call -y -d com.redhat.tuned -o /Tuned -m com.redhat.tuned.control.instance_create cpu "$EVIL" '{"devices": "*"}'
The vulnerabilities are present starting from tuned version 2.23, released in early June 2024, and are fixed in tuned version 2.24.1. The issues have been resolved in major distributions such as RHEL 9, Fedora 40, Arch Linux, and Gentoo. In the stable branches of Ubuntu, Debian, and SUSE/openSUSE, the vulnerabilities are not present as they ship older versions of tuned (<2.23), which are not affected by the vulnerabilities.
Source: opennet.ru
