CVE-2024-52336
HIGH EPSS 20.4%
Published Nov 26, 20241y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
Published Nov 26, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
Description
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
20.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-269 Improper Privilege Management Authorization
References 8
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:10384
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:0879
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:0880
- access.redhat.com https://access.redhat.com/security/cve/CVE-2024-52336
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2324540
- security.opensuse.org https://security.opensuse.org/2024/11/26/tuned-instance-create.html
- openwall.com https://www.openwall.com/lists/oss-security/2024/11/28/1
- openwall.com https://www.openwall.com/lists/oss-security/2024/11/28/2
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.