CVE-2024-52337

Name	CVE-2024-52337
Description	A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1088635

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tuned (PTS)	bullseye	2.15.0-1	fixed
	bookworm	2.20.0-1	fixed
	sid, trixie	2.24.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tuned	source	bullseye	(not affected)
tuned	source	bookworm	(not affected)
tuned	source	(unstable)	2.24.1-1	1088635

Notes

[bookworm] - tuned <not-affected> (Vulnerable code introduced later)
[bullseye] - tuned <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2324541
https://www.openwall.com/lists/oss-security/2024/11/28/1
Introduced with: https://github.com/redhat-performance/tuned/commit/cddcd2336944a56e313324c699dd739fe8f1f85d (v2.23.0)
Fixed by: https://github.com/redhat-performance/tuned/commit/90c24eea037c7a5e9414c93f8fb3e549ed4a7b06 (v2.24.1)