Red Hat Fast Datapath for RHEL/Enterprise Linux API input validation

Summaryinfo

A vulnerability classified as problematic has been found in Red Hat Fast Datapath for RHEL and Enterprise Linux. Affected by this vulnerability is an unknown functionality of the component API. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2024-52337. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Red Hat Fast Datapath for RHEL and Enterprise Linux (version now known) and classified as problematic. This issue affects some unknown processing of the component API. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity. The summary by CVE is:

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2024-52337 since 11/08/2024. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/02/2025).

The vulnerability scanner Nessus provides a plugin with the ID 211879 (RHEL 7 : tuned (RHSA-2024:10381)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (211879) and EUVD (EUVD-2024-46269). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux
• Fast Datapath for RHEL

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion