The tuned service in Red Hat Enterprise Linux 9, which adjusts system settings based on selected profiles, contained two vulnerabilities. CVE-2024-52336 permits an attacker to pass arbitrary scripts through the 'script_pre' and 'script_post' options, which are executed with root privileges, potentially leading to privilege escalation. CVE-2024-52337 involves improper sanitization of the 'instance_name' parameter in the instance_create() method, which could lead to unexpected behavior or security issues. Red Hat has issued an important security advisory (RHSA-2024:10384) with updates that fix these vulnerabilities across various Red Hat Enterprise Linux 9 product variants and architectures.

Successful exploitation of CVE-2024-52336 could allow an attacker to execute arbitrary code with root privileges on affected systems, representing a significant security risk. CVE-2024-52337's improper input sanitization could lead to security issues related to instance creation, potentially enabling unauthorized actions or system compromise. Both vulnerabilities affect Red Hat Enterprise Linux 9 and its extended update support versions across multiple architectures and product variants.

Red Hat has released an important security update (RHSA-2024:10384) that addresses these vulnerabilities. Users should apply the updated tuned packages as detailed in the Red Hat advisory and the referenced article https://access.redhat.com/articles/11258. Applying this official update mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.