// For flags

CVE-2023-6917

Pcp: unsafe use of directories allows pcp to root privilege escalation

Severity Score

6.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.

Se ha identificado una vulnerabilidad en el paquete Performance Co-Pilot (PCP), derivada de los niveles de privilegios mixtos utilizados por los servicios systemd asociados con PCP. Si bien ciertos servicios operan dentro de los límites de privilegios limitados de usuario/grupo de PCP, a otros se les otorgan privilegios completos de raíz. Esta disparidad en los niveles de privilegios plantea un riesgo cuando los procesos raíz privilegiados interactúan con directorios o árboles de directorios propiedad de usuarios PCP sin privilegios. Específicamente, esta vulnerabilidad puede comprometer el aislamiento del usuario de PCP y facilitar ataques locales de PCP a raíz, particularmente a través de ataques de enlace simbólico. Estas vulnerabilidades subrayan la importancia de mantener mecanismos sólidos de separación de privilegios dentro de PCP para mitigar la posibilidad de una escalada de privilegios no autorizada.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Local
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-12-18 CVE Reserved
  • 2024-02-28 CVE Published
  • 2024-05-01 EPSS Updated
  • 2024-11-23 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-378: Creation of Temporary File With Insecure Permissions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
*-
Affected
Oracle
Search vendor "Oracle"
 Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Suse
Search vendor "Suse"
 Sle-module-development-tools
Search vendor "Suse" for product "Sle-module-development-tools"
*-
Affected