Описание
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
Отчет
This flaw is rated as Important because it allows a local attacker to achieve arbitrary command execution as the PMDA process user within the Performance Co-Pilot (PCP) environment. Exploitation requires the linux_sockets PMDA to be loaded and the ss utility to be present, which are common configurations. The vulnerability stems from an inverted validation logic in the sockets_check_filter() function, enabling the injection of malicious shell metacharacters into a filter value that is later executed.
Меры по смягчению последствий
To prevent exploitation, restrict access to the pmstore utility by configuring the [access] section in /etc/pcp/pmcd/pmcd.conf. If the linux_sockets PMDA is not essential, it can be unloaded or disabled to remove the attack vector. After modifying pmcd.conf, the pmcd service must be restarted for changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | pcp | Affected | ||
| Red Hat Enterprise Linux 6 | pcp | Out of support scope | ||
| Red Hat Enterprise Linux 7 | pcp | Affected | ||
| Red Hat Enterprise Linux 8 | pcp | Affected | ||
| Red Hat Enterprise Linux 9 | pcp | Affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
A command injection flaw in PCP's linux_sockets PMDA allows malicious ...
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
EPSS
7.8 High
CVSS3