Summary
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.
Security Fix(es):
* pcp: pmpost symlink attack allows escalating pcp to root user (CVE-2024-45770)
* pcp: pmcd heap corruption through metric pmstore operations (CVE-2024-45769)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | pcp | 0:5.3.7-22.el8_10 |
Vulnerabilities 2
-
Medium 5.5
Pcp: pmcd heap corruption through metric pmstore operations
A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
-
Medium 4.4
Pcp: pmpost symlink attack allows escalating pcp to root user
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditi…