{"id":"AZL-53696","summary":"CVE-2024-52336 affecting package tuned for versions less than 2.15.0-5","details":"A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.","modified":"2026-04-21T04:35:20.220591Z","published":"2024-11-26T16:15:17Z","upstream":["CVE-2024-52336"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52336"}],"affected":[{"package":{"name":"tuned","ecosystem":"Azure Linux:2","purl":"pkg:rpm/azure-linux/tuned"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-5"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-53696.json"}}],"schema_version":"1.7.5"}