The tuned service in Red Hat Enterprise Linux Fast Datapath 8 had two security issues. CVE-2024-52337 is caused by improper sanitization of the instance_name parameter in the instance_create() method, which could lead to unexpected behavior or privilege escalation. CVE-2024-52336 involves the script_pre and script_post options that allow passing arbitrary scripts executed with root privileges, posing a significant risk of unauthorized code execution. Red Hat has released updated tuned packages to fix these vulnerabilities.

If exploited, these vulnerabilities could allow an attacker with access to the tuned service to execute arbitrary scripts as root, leading to full system compromise. Improper sanitization of input parameters may also allow privilege escalation or other unintended effects. The severity is rated as high by Red Hat, indicating a serious security risk if unpatched.

Red Hat has released updated tuned packages that fix these vulnerabilities. Users should apply the security update RHSA-2025:0880 for Red Hat Enterprise Linux Fast Datapath 8 as soon as possible. Before applying this update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available from Red Hat's official documentation. No alternative mitigations or workarounds are indicated in the advisory.