CVE-2023-6917 Pcp: unsafe use of directories allows pcp to root privilege escalation
Local attackers can escalate privileges to root via symlink attacks due to unsafe directory handling in Performance Co-Pilot services.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6917?
CVE-2023-6917 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 28 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
Weakness: CWE-367
Which versions are affected by CVE-2023-6917?
It affects 2 products.
Linux distribution packages (40)
pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-conf AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-devel AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-doc AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2elasticsearch AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2graphite AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2influxdb AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2json AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2spark AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2xml AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-pcp2zabbix AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-export-zabbix-agent AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-geolocate AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-gui AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-import-collectl2pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-import-ganglia2pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-import-iostat2pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-import-mrtg2pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-import-sar2pcp AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-libs AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-libs-devel AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-activemq AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-apache AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bash AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bcc AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bind2 AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bonding AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bpf AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-bpftrace AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-cifs AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-cisco AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-dbping AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-denki AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-dm AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-docker AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-ds389 AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-ds389log AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-elasticsearch AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-farm AlmaLinux:9 | All versions | 6.2.0-1.el9 |
pcp-pmda-gfs2 AlmaLinux:9 | All versions | 6.2.0-1.el9 |
Products include Redhat Enterprise Linux, Sgi Performance Co-Pilot.
How do I fix CVE-2023-6917?
Apply the vendor's patch.
Is CVE-2023-6917 being exploited?
There is no known exploitation of CVE-2023-6917 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as ALSA-2024:2213, DEBIAN-CVE-2023-6917, GHSA-pgw3-qmf6-36m3, OESA-2024-2018, RHSA-2024:2213, SUSE-SU-2025:0801-1 and 1 more.