Vulnerability · Published Sep 19, 2024 · Assigned by redhat

CVE-2024-45770Pcp: pmpost symlink attack allows escalating pcp to root user

Medium 4.4

In plain English

A medium-severity security flaw in pcp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-conf5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-conf6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-conf6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-devel5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-devel6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-devel6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-doc5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-doc6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-doc6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-export-pcp2elasticsearch5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2elasticsearch6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-export-pcp2elasticsearch6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-export-pcp2graphite5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2graphite6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-export-pcp2graphite6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-export-pcp2influxdb5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2influxdb6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-export-pcp2influxdb6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-export-pcp2json5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2json6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-export-pcp2json6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-export-pcp2openmetrics6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-export-pcp2spark5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2spark6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-export-pcp2spark6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-export-pcp2xml5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2xml6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-export-pcp2xml6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-export-pcp2zabbix5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-pcp2zabbix6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-export-pcp2zabbix6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-export-zabbix-agent5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-export-zabbix-agent6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-export-zabbix-agent6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-geolocate6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-geolocate6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-gui5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-gui6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-gui6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-import-collectl2pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-import-collectl2pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-import-collectl2pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-import-ganglia2pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-import-ganglia2pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-import-ganglia2pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-import-iostat2pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-import-iostat2pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-import-iostat2pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-import-mrtg2pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-import-mrtg2pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-import-mrtg2pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-import-sar2pcp5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-import-sar2pcp6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-import-sar2pcp6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-libs5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-libs6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-libs6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-libs-devel5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-libs-devel6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-libs-devel6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-activemq5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-activemq6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-activemq6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-apache5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-apache6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-apache6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-bash5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-bash6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-bash6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-bcc5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-bcc6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-bcc6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-bind25.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-bind26.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-bind26.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-bonding5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-bonding6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-bonding6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-bpf6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-bpf6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-bpftrace5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-bpftrace6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-bpftrace6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-cifs5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-cifs6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-cifs6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-cisco5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-cisco6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-cisco6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-dbping5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-dbping6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-dbping6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-denki5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-denki6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-denki6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-dm5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-dm6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-dm6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-docker5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-docker6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-docker6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-ds3895.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-ds3896.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-ds3896.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-ds389log5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-ds389log6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-ds389log6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-elasticsearch5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-elasticsearch6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-elasticsearch6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-farm6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-farm6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-gfs25.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-gfs26.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-gfs26.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-gluster5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-gluster6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-gluster6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-gpfs5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-gpfs6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-gpfs6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-gpsd5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-gpsd6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-gpsd6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-hacluster5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-hacluster6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-hacluster6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-haproxy5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-haproxy6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-haproxy6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-infiniband5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-infiniband6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-infiniband6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-json5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-json6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-json6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-libvirt5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-libvirt6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-libvirt6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-lio5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-lio6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-lio6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-lmsensors5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-lmsensors6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-lmsensors6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-logger5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-logger6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-logger6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-lustre5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-lustre6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-lustre6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-lustrecomm5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-lustrecomm6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-lustrecomm6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-mailq5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mailq6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-mailq6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-memcache5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-memcache6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-memcache6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-mic5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mic6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-mic6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-mongodb5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mongodb6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-mongodb6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-mounts5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mounts6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-mounts6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-mssql5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mssql6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-mssql6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-mysql5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-mysql6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-mysql6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-named5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-named6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-named6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-netcheck5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-netcheck6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-netcheck6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-netfilter5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-netfilter6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-netfilter6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-news5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-news6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-news6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-nfsclient5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-nfsclient6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-nfsclient6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-nginx5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-nginx6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:9pcp-pmda-nginx6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:8pcp-pmda-nvidia-gpu5.3.7-22.el8_10ALSA-2024:6837
AlmaLinux:9pcp-pmda-nvidia-gpu6.2.0-5.el9_4ALSA-2024:6848
AlmaLinux:9pcp-pmda-nvidia-gpu6.2.2-7.el9_5.alma.1ALSA-2024:9452
AlmaLinux:8pcp-pmda-openmetrics5.3.7-22.el8_10ALSA-2024:6837

Affected products (as reported)

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References