{"id":120749,"date":"2024-11-28T21:45:59","date_gmt":"2024-11-28T19:45:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2024-11-28T21:45:59","modified_gmt":"2024-11-28T19:45:59","slug":"uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-tuned-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"A vulnerability in tuned that allows executing code with root privileges","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2024-52336) has been identified in the background process tuned, developed by Red Hat, which performs automatic optimization of hardware and kernel settings based on current load, allowing a local unprivileged user to execute any commands with root privileges. <\/p>\n
The issue exists in the implementation of the DBus method «com.redhat.tuned.instance_create», used for creating plugin instances, which accepts «script_pre» and «script_post» parameters to specify the scripts executed before or after the creation of the plugin instance. The problem is that Polkit settings allow any authenticated local user to send a DBus request to this method without authentication, while the tuned process itself runs with root privileges and executes the scripts specified in the «script_pre» and «script_post» parameters with root privileges as well. For example, to run the script \/path\/to\/myscript.sh with root privileges, a user simply needs to execute the command: gdbus call -y -d com.redhat.tuned -o \/Tuned \\ -m com.redhat.tuned.control.instance_create cpu myinstance ‘{«script_pre»: «\/path\/to\/myscript.sh», «devices»: «*»}’ <\/p>\n
The DBus method «com.redhat.tuned.instance_create» also contains a less severe vulnerability (CVE-2024-52337), caused by the lack of sanitization of the plugin instance name when logged. An attacker can add a name that includes newline and escape characters for the terminal emulator, which can be used to disrupt the log structure and trigger actions when displaying the output of the command «tuned-adm get_instances» in the terminal. EVIL=`echo -e «this is\nevil\033[?1047h»` gdbus call -y -d com.redhat.tuned -o \/Tuned -m com.redhat.tuned.control.instance_create cpu «$EVIL» ‘{«devices»: «*»}’ <\/p>\n
The vulnerabilities are present starting from tuned version 2.23, released in early June 2024, and are fixed in tuned version 2.24.1. The issues have been resolved in major distributions such as RHEL 9, Fedora 40, Arch Linux, and Gentoo. In the stable branches of Ubuntu, Debian, and SUSE\/openSUSE, the vulnerabilities are not present as they ship older versions of tuned (<2.23), which are not affected by the vulnerabilities. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"