The tuned packages provide a service that tunes system settings according to selected profiles. Two vulnerabilities were fixed: CVE-2024-52337, which is caused by improper sanitization of the instance_name parameter in the instance_create() method, and CVE-2024-52336, which allows arbitrary scripts to be passed and executed as root through the script_pre and script_post options. These vulnerabilities affect Red Hat Enterprise Linux Fast Datapath 9 across multiple architectures. Red Hat released updated tuned packages as part of advisory RHSA-2025:0879 to remediate these issues.

Successful exploitation of CVE-2024-52336 could allow an attacker to execute arbitrary scripts with root privileges, leading to full system compromise. CVE-2024-52337 involves improper input sanitization that could be leveraged to bypass security controls or cause unexpected behavior in the tuned service. Both vulnerabilities pose a high security risk due to potential privilege escalation and unauthorized code execution.

Red Hat has released updated tuned packages as part of advisory RHSA-2025:0879 to fix these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified by the vendor.