A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
Published 2024-02-28 15:15:08
Updated 2024-04-30 14:15:13
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Gain privilege

Products affected by CVE-2023-6917

Please log in to view affected product information.

Exploit prediction scoring system (EPSS) score for CVE-2023-6917

0.05%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-6917

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.0
MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
0.8
5.2
Red Hat, Inc. 2024-02-28

CWE ids for CVE-2023-6917

References for CVE-2023-6917

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!