Alma Linux: CVE-2024-52337: Moderate: tuned security update (Multiple Advisories)

Alma Linux: CVE-2024-52337: Moderate: tuned security update (Multiple Advisories)

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

11/26/2024

Created

12/05/2024

Added

12/04/2024

Modified

12/19/2024

Description

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.

Solution(s)

• alma-upgrade-tuned
• alma-upgrade-tuned-gtk
• alma-upgrade-tuned-ppd
• alma-upgrade-tuned-profiles-atomic
• alma-upgrade-tuned-profiles-compat
• alma-upgrade-tuned-profiles-cpu-partitioning
• alma-upgrade-tuned-profiles-mssql
• alma-upgrade-tuned-profiles-oracle
• alma-upgrade-tuned-profiles-postgresql
• alma-upgrade-tuned-profiles-realtime
• alma-upgrade-tuned-profiles-spectrumscale
• alma-upgrade-tuned-utils
• alma-upgrade-tuned-utils-systemtap

References

• https://attackerkb.com/topics/cve-2024-52337
• CVE - 2024-52337
• https://errata.almalinux.org/8/ALSA-2024-11161.html
• https://errata.almalinux.org/9/ALSA-2024-10384.html