RHBA-2013:0386

Vulnerability from csaf_redhat - Published: 2013-02-20 15:51 - Updated: 2025-11-21 17:20
Summary
Red Hat Bug Fix Advisory: tuned bug fix update

Notes

Topic
Updated tuned packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
Details
The tuned packages contain a daemon that tunes system settings dynamically. It does so by monitoring the usage of several system components periodically. This update fixes the following bugs: * Red Hat Enterprise Linux 6.1 and later enters processor power-saving states more aggressively. This could result in a small performance penalty on certain workloads. With this update, the pmqos-static.py daemon has been added to the tuned packages, which allows to set the requested latency using the kernel Power Management QoS interface. It is run when the "latency-performance" profile is activated and it sets cpu_dma_latency=0, which keeps the CPU in C0 state, thus making the system as responsive as possible. (BZ#714180) * When the ELEVATOR_TUNE_DEVS option was set to a disk device in the /etc/sysconfig/ktune file instead of providing a disk scheduler control file, the scheduler setting was not written to a disk scheduler control file but directly into the disk device file. Consequently, contents of the disk could become corrupted. With this update, the value of ELEVATOR_TUNE_DEVS is checked and only the disk scheduler control file is allowed for writing. As a result, an invalid value of ELEVATOR_TUNE_DEVS is detected in the described scenario so that the disk contents damage can be prevented. (BZ#784308) * When the tuned daemon run with the "enterprise-storage" profile enabled and a non-root, non-boot disk partition from a device with write-back cache was mounted, tuned remounted the partition with the "nobarriers" option. If a power failure occurred at that time, the file system could become corrupted. With this update, tuned can detect usage of write-back cache on devices communicating with kernel via SCSI. In these cases, "nobarriers" is now disabled, thus preventing this bug in the described scenario. (BZ#801561) * Previously, when the tuned service was started, the tuned PID file was created with world-writable permissions. This bug has been fixed and the /var/run/tuned/tuned.pid file is now created with correct permissions as expected. (BZ#845336) * On a machine with hot-plug disk devices with the "enterprise-storage" profile activated, a new disk device could be added into the system, or the disk could be removed and inserted back. In such a scenario, the scheduler and read-ahead settings from the profile were not applied on the newly-added disks. With this update, a new udev rule has been added, which restarts the ktune daemon whenever a new disk device is added, thus fixing this bug. (BZ#847445) * The transparent hugepage kernel thread could interfere with latency-sensitive applications. To lower the latency, the transparent hugepages are now disabled in the latency-performance tuned profile. (BZ#887355) * Previously, non-root, non-boot partitions were re-mounted using the "nobarrier" option to improve performance. On virtual guests, this could lead to data corruption if power supply was suddenly interrupted, because there was usually a host cache in transfer. This bug has been fixed and the virtual-guest profile no longer re-mounts partitions using "nobarrier". (BZ#886956) Users of tuned are advised to upgrade to these updated packages, which fix these bugs.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tuned packages that fix several bugs are now available for Red Hat Enterprise Linux 6.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The tuned packages contain a daemon that tunes system settings dynamically. It does so by monitoring the usage of several system components periodically. \n\nThis update fixes the following bugs:\n\n* Red Hat Enterprise Linux 6.1 and later enters processor power-saving states more aggressively. This could result in a small performance penalty on certain workloads. With this update, the pmqos-static.py daemon has been added to the tuned packages, which allows to set the requested latency using the kernel Power Management QoS interface. It is run when the \"latency-performance\" profile is activated and it sets cpu_dma_latency=0, which keeps the CPU in C0 state, thus making the system as responsive as possible. (BZ#714180)\n\n* When the ELEVATOR_TUNE_DEVS option was set to a disk device in the /etc/sysconfig/ktune file instead of providing a disk scheduler control file, the scheduler setting was not written to a disk scheduler control file but directly into the disk device file. Consequently, contents of the disk could become corrupted. With this update, the value of ELEVATOR_TUNE_DEVS is checked and only the disk scheduler control file is allowed for writing. As a result, an invalid value of ELEVATOR_TUNE_DEVS is detected in the described scenario so that the disk contents damage can be prevented. (BZ#784308)\n\n* When the tuned daemon run with the \"enterprise-storage\" profile enabled and a non-root, non-boot disk partition from a device with write-back cache was mounted, tuned remounted the partition with the \"nobarriers\" option. If a power failure occurred at that time, the file system could become corrupted. With this update, tuned can detect usage of write-back cache on devices communicating with kernel via SCSI. In these cases, \"nobarriers\" is now disabled, thus preventing this bug in the described scenario. (BZ#801561)\n\n* Previously, when the tuned service was started, the tuned PID file was created with world-writable permissions. This bug has been fixed and the /var/run/tuned/tuned.pid file is now created with correct permissions as expected. (BZ#845336)\n\n* On a machine with hot-plug disk devices with the \"enterprise-storage\" profile activated, a new disk device could be added into the system, or the disk could be removed and inserted back. In such a scenario, the scheduler and read-ahead settings from the profile were not applied on the newly-added disks. With this update, a new udev rule has been added, which restarts the ktune daemon whenever a new disk device is added, thus fixing this bug. (BZ#847445)\n\n* The transparent hugepage kernel thread could interfere with latency-sensitive applications. To lower the latency, the transparent hugepages are now disabled in the latency-performance tuned profile. (BZ#887355)\n\n* Previously, non-root, non-boot partitions were re-mounted using the \"nobarrier\" option to improve performance. On virtual guests, this could lead to data corruption if power supply was suddenly interrupted, because there was usually a host cache in transfer. This bug has been fixed and the virtual-guest profile no longer re-mounts partitions using \"nobarrier\". (BZ#886956)\n\nUsers of tuned are advised to upgrade to these updated packages, which fix these bugs.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2013:0386",
        "url": "https://access.redhat.com/errata/RHBA-2013:0386"
      },
      {
        "category": "external",
        "summary": "784308",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=784308"
      },
      {
        "category": "external",
        "summary": "801561",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=801561"
      },
      {
        "category": "external",
        "summary": "845336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=845336"
      },
      {
        "category": "external",
        "summary": "887355",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=887355"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhba-2013_0386.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: tuned bug fix update",
    "tracking": {
      "current_release_date": "2025-11-21T17:20:56+00:00",
      "generator": {
        "date": "2025-11-21T17:20:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHBA-2013:0386",
      "initial_release_date": "2013-02-20T15:51:55+00:00",
      "revision_history": [
        {
          "date": "2013-02-20T15:51:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-02-20T15:51:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:20:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                  "product_id": "6Client",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                  "product_id": "6ComputeNode",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tuned-utils-0:0.2.19-11.el6.noarch",
                "product": {
                  "name": "tuned-utils-0:0.2.19-11.el6.noarch",
                  "product_id": "tuned-utils-0:0.2.19-11.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tuned-utils@0.2.19-11.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tuned-0:0.2.19-11.el6.noarch",
                "product": {
                  "name": "tuned-0:0.2.19-11.el6.noarch",
                  "product_id": "tuned-0:0.2.19-11.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tuned@0.2.19-11.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tuned-0:0.2.19-11.el6.src",
                "product": {
                  "name": "tuned-0:0.2.19-11.el6.src",
                  "product_id": "tuned-0:0.2.19-11.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tuned@0.2.19-11.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:tuned-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:tuned-0:0.2.19-11.el6.src"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.src",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-utils-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client:tuned-utils-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-utils-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:tuned-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:tuned-0:0.2.19-11.el6.src"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.src",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-utils-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode:tuned-utils-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-utils-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6ComputeNode"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:tuned-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:tuned-0:0.2.19-11.el6.src"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.src",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-utils-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server:tuned-utils-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-utils-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:tuned-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-0:0.2.19-11.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:tuned-0:0.2.19-11.el6.src"
        },
        "product_reference": "tuned-0:0.2.19-11.el6.src",
        "relates_to_product_reference": "6Workstation"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-utils-0:0.2.19-11.el6.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation:tuned-utils-0:0.2.19-11.el6.noarch"
        },
        "product_reference": "tuned-utils-0:0.2.19-11.el6.noarch",
        "relates_to_product_reference": "6Workstation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-6136",
      "discovery_date": "2013-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "918813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tuned: insecure permissions of tuned.pid",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client:tuned-0:0.2.19-11.el6.noarch",
          "6Client:tuned-0:0.2.19-11.el6.src",
          "6Client:tuned-utils-0:0.2.19-11.el6.noarch",
          "6ComputeNode:tuned-0:0.2.19-11.el6.noarch",
          "6ComputeNode:tuned-0:0.2.19-11.el6.src",
          "6ComputeNode:tuned-utils-0:0.2.19-11.el6.noarch",
          "6Server:tuned-0:0.2.19-11.el6.noarch",
          "6Server:tuned-0:0.2.19-11.el6.src",
          "6Server:tuned-utils-0:0.2.19-11.el6.noarch",
          "6Workstation:tuned-0:0.2.19-11.el6.noarch",
          "6Workstation:tuned-0:0.2.19-11.el6.src",
          "6Workstation:tuned-utils-0:0.2.19-11.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6136"
        },
        {
          "category": "external",
          "summary": "RHBZ#918813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6136"
        }
      ],
      "release_date": "2012-08-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-02-20T15:51:55+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Client:tuned-0:0.2.19-11.el6.noarch",
            "6Client:tuned-0:0.2.19-11.el6.src",
            "6Client:tuned-utils-0:0.2.19-11.el6.noarch",
            "6ComputeNode:tuned-0:0.2.19-11.el6.noarch",
            "6ComputeNode:tuned-0:0.2.19-11.el6.src",
            "6ComputeNode:tuned-utils-0:0.2.19-11.el6.noarch",
            "6Server:tuned-0:0.2.19-11.el6.noarch",
            "6Server:tuned-0:0.2.19-11.el6.src",
            "6Server:tuned-utils-0:0.2.19-11.el6.noarch",
            "6Workstation:tuned-0:0.2.19-11.el6.noarch",
            "6Workstation:tuned-0:0.2.19-11.el6.src",
            "6Workstation:tuned-utils-0:0.2.19-11.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2013:0386"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:H/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "products": [
            "6Client:tuned-0:0.2.19-11.el6.noarch",
            "6Client:tuned-0:0.2.19-11.el6.src",
            "6Client:tuned-utils-0:0.2.19-11.el6.noarch",
            "6ComputeNode:tuned-0:0.2.19-11.el6.noarch",
            "6ComputeNode:tuned-0:0.2.19-11.el6.src",
            "6ComputeNode:tuned-utils-0:0.2.19-11.el6.noarch",
            "6Server:tuned-0:0.2.19-11.el6.noarch",
            "6Server:tuned-0:0.2.19-11.el6.src",
            "6Server:tuned-utils-0:0.2.19-11.el6.noarch",
            "6Workstation:tuned-0:0.2.19-11.el6.noarch",
            "6Workstation:tuned-0:0.2.19-11.el6.src",
            "6Workstation:tuned-utils-0:0.2.19-11.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tuned: insecure permissions of tuned.pid"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.