CVE-2023-6917: Pcp: unsafe use of directories allows pcp to root privilege escalation
A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
Other sources
Security issues in pcp on Linux were found by Matthias Gerstner (SUSE Linux security team). The systemd services coming with pcp run with mixed privileges. Some use only limited pcp user/group privileges, like "pmiecheck.service". Others like "pmcd.service" run with full root privileges. In both contexts shared directory structures are used, though, like:
- /var/lib/pcp/tmp owned by pcp:pcp mode 775 - /var/log/pcp owned by pcp:pcp mode 775
When privileged root processes access files in directories or directory trees controlled by unprivileged users then easily security issues can result from this. For the directories listed above two exploitable issues were found that allow to break the pcp user isolation and allow local pcp to root exploits (via symlink attacks).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6917?
CVE-2023-6917 is classified as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2023-6917?
To mitigate CVE-2023-6917, update the Performance Co-Pilot package to version 6.2.0 or later.
What systems are affected by CVE-2023-6917?
CVE-2023-6917 affects the Performance Co-Pilot (PCP) package on systems running Red Hat Enterprise Linux 9.0 and versions up to 6.2.0.
What type of vulnerability is CVE-2023-6917?
CVE-2023-6917 is a privilege escalation vulnerability stemming from mixed privilege levels of systemd services related to PCP.
Who is impacted by CVE-2023-6917?
Users and administrators of systems utilizing the Performance Co-Pilot package are at risk from CVE-2023-6917.