CVE-2024-52336

What it actually does

The instance_create D-Bus method in Tuned accepts unauthenticated calls from local users and accepts attacker-supplied absolute paths in script_pre or script_post parameters; Tuned then executes those scripts as root.

Why it matters to the business

Any local user on an affected system can obtain full root access, allowing complete compromise of the host and any data or services running on it; the flaw affects widely deployed Linux systems and must be addressed urgently despite low public exploit activity.

How an attack unfolds

An attacker with local shell access crafts a D-Bus call to instance_create, supplying a path to a malicious script in the script_pre or script_post field; Tuned executes the script with root privileges, granting the attacker a root shell.

How to fix it

Upgrade Tuned to a fixed version; on Ubuntu 16.04 LTS install web2py package version 2.12.3-1ubuntu0.1 or newer. If patching is delayed, restrict local D-Bus access to Tuned via policy or disable the service when not required.

How to confirm the fix worked

Confirm the installed Tuned package version is at or above the fixed release listed for the distribution; attempt an unauthenticated D-Bus call to instance_create and verify that script_pre/script_post parameters are rejected or sanitized.

Typical attack path

1. Obtain local non-root shell on target system
2. Connect to the system D-Bus and invoke Tuned's instance_create method
3. Supply absolute path of attacker-controlled executable in script_pre or script_post
4. Tuned executes the supplied script as root
5. Attacker receives root privileges and can install persistence or move laterally

How to detect it

Review system D-Bus logs and Tuned service logs for calls to instance_create that include unexpected script_pre or script_post values; look for new root-owned processes or files created shortly after such calls.

What your security team should do

• Apply the vendor-supplied package update immediately on all affected hosts
• Audit systems for any locally created Tuned profiles that reference scripts
• Monitor D-Bus logs for unexpected instance_create calls until patches are deployed