Red Hat Security Advisory

RHSA-2025:0880

tuned security update

Released 2025-02-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fast Datapath for Red Hat Enterprise Linux 8 tuned-2.24.0-2.1.20240819gitc082797f.el8fdp, tuned-gtk-2.24.0-2.1.20240819gitc082797f.el8fdp, tuned-ppd-2.24.0-2.1.20240819gitc082797f.el8fdp +16

Fixes 2 records

TI-2024-35008 CVE-2024-52336 · GHSA-cfjc-m7fv-63xj

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

LOW 36

A script injection vulnerability was identified in the Tuned package.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00301 Published 2024-11-26 Partial fix · 2.24.1, 2.24.0-2.1.20240819gitc082797f.el8fdp +2 CWE-269

TI-2024-35009 CVE-2024-52337 · GHSA-8c3c-gvf8-p7v2

Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

LOW 25

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.003 Published 2024-11-26 Partial fix · 2.24.1, 2.11.0-5.el7fdp.2 +10 CWE-20