CVE-2024-45770: Pcp: pmpost symlink attack allows escalating pcp to root user
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Other sources
This issue is somewhat similar to CVE-2023-6917 from a previous audit.
pmpost is used to append messages to the "PCP notice board". It is called from different contexts, one of which is as root from within the pmcd startup script. The program writes the message provided on the command line to the file in /var/log/pcp/NOTICES.
The directory /var/log/pcp belongs to pcp:pcp. The file is opened without passing the ONOFOLLOW flag, thus it will open symlinks placed there by the pcp user. This would allow pmpost to be coerced into creating new files in arbitrary locations, or to corrupt arbitrary existing files in the system.
Furthermore, if the NOTICES file is newly created and pmpost runs as root, then a fchown() to pcp:pcp is executed on the file. Thus it allows to pass the ownership of arbitrary newly created files in the system to pcp:pcp.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45770?
The severity of CVE-2024-45770 is considered high due to the potential for exploiting the vulnerability by an attacker with access to a compromised Performance Co-Pilot account.
How do I fix CVE-2024-45770?
To fix CVE-2024-45770, update to the latest version of Performance Co-Pilot that addresses this vulnerability.
Who is affected by CVE-2024-45770?
CVE-2024-45770 affects systems using Performance Co-Pilot, particularly those relying on the pmpost tool.
What kind of attack vector does CVE-2024-45770 utilize?
CVE-2024-45770 can be exploited if an attacker gains access to a compromised Performance Co-Pilot account, enabling them to leverage the pmpost tool.
What is the impact of CVE-2024-45770?
The impact of CVE-2024-45770 includes potential unauthorized message logging and manipulation due to the vulnerabilities present in the pmpost tool.