CVE-2024-45770 Pcp: pmpost symlink attack allows escalating pcp to root user
A symlink attack in the pmpost tool allows local attackers with compromised PCP accounts to escalate privileges to root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45770?
CVE-2024-45770 is a medium-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 19 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Weakness: CWE-59
Which versions are affected by CVE-2024-45770?
How do I fix CVE-2024-45770?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-45770 being exploited?
There is no known exploitation of CVE-2024-45770 in the wild and no public exploit code.
Sources
Also known as AZL-49653, AZL-49659, DEBIAN-CVE-2024-45770, GHSA-cjc3-7r36-pp49, UBUNTU-CVE-2024-45770.