{"id":"UBUNTU-CVE-2023-6917","details":"A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.","modified":"2026-05-20T16:16:29.724547441Z","published":"2024-02-28T15:15:00Z","upstream":["CVE-2023-6917"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-6917"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2023-6917"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254983"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-6917"}],"affected":[{"package":{"name":"pcp","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.6","3.10.8","3.10.8build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpcp-gui2","binary_version":"3.10.8build1"},{"binary_version":"3.10.8build1","binary_name":"libpcp-import-perl"},{"binary_name":"libpcp-import1","binary_version":"3.10.8build1"},{"binary_version":"3.10.8build1","binary_name":"libpcp-logsummary-perl"},{"binary_version":"3.10.8build1","binary_name":"libpcp-mmv-perl"},{"binary_name":"libpcp-mmv1","binary_version":"3.10.8build1"},{"binary_name":"libpcp-pmda-perl","binary_version":"3.10.8build1"},{"binary_version":"3.10.8build1","binary_name":"libpcp-pmda3"},{"binary_version":"3.10.8build1","binary_name":"libpcp-trace2"},{"binary_version":"3.10.8build1","binary_name":"libpcp3"},{"binary_name":"pcp","binary_version":"3.10.8build1"},{"binary_name":"pcp-conf","binary_version":"3.10.8build1"},{"binary_name":"pcp-gui","binary_version":"3.10.8build1"},{"binary_name":"pcp-import-collectl2pcp","binary_version":"3.10.8build1"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"3.10.8build1"},{"binary_name":"pcp-import-iostat2pcp","binary_version":"3.10.8build1"},{"binary_version":"3.10.8build1","binary_name":"pcp-import-mrtg2pcp"},{"binary_name":"pcp-import-sar2pcp","binary_version":"3.10.8build1"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"3.10.8build1"},{"binary_name":"pcp-manager","binary_version":"3.10.8build1"},{"binary_name":"pcp-testsuite","binary_version":"3.10.8build1"},{"binary_version":"3.10.8build1","binary_name":"python-pcp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1","3.12.2-1","4.0.0-1","4.0.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"4.0.1-1","binary_name":"libpcp-gui2"},{"binary_version":"4.0.1-1","binary_name":"libpcp-import-perl"},{"binary_version":"4.0.1-1","binary_name":"libpcp-import1"},{"binary_name":"libpcp-logsummary-perl","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"libpcp-mmv-perl"},{"binary_name":"libpcp-mmv1","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"libpcp-pmda-perl"},{"binary_version":"4.0.1-1","binary_name":"libpcp-pmda3"},{"binary_name":"libpcp-trace2","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"libpcp-web1"},{"binary_version":"4.0.1-1","binary_name":"libpcp3"},{"binary_name":"pcp","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"pcp-conf"},{"binary_version":"4.0.1-1","binary_name":"pcp-export-pcp2graphite"},{"binary_name":"pcp-export-pcp2influxdb","binary_version":"4.0.1-1"},{"binary_name":"pcp-export-zabbix-agent","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"pcp-gui"},{"binary_name":"pcp-import-collectl2pcp","binary_version":"4.0.1-1"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"4.0.1-1"},{"binary_version":"4.0.1-1","binary_name":"pcp-import-iostat2pcp"},{"binary_name":"pcp-import-mrtg2pcp","binary_version":"4.0.1-1"},{"binary_name":"pcp-import-sar2pcp","binary_version":"4.0.1-1"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"4.0.1-1"},{"binary_name":"pcp-manager","binary_version":"4.0.1-1"},{"binary_name":"pcp-testsuite","binary_version":"4.0.1-1"},{"binary_name":"pcp-webapi","binary_version":"4.0.1-1"},{"binary_name":"python-pcp","binary_version":"4.0.1-1"},{"binary_name":"python3-pcp","binary_version":"4.0.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1build1","4.3.4-1build2","5.0.0-1","5.0.1-1","5.0.2-1.1","5.0.2-1.1build1","5.0.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpcp-gui2","binary_version":"5.0.3-1"},{"binary_name":"libpcp-import-perl","binary_version":"5.0.3-1"},{"binary_name":"libpcp-import1","binary_version":"5.0.3-1"},{"binary_name":"libpcp-logsummary-perl","binary_version":"5.0.3-1"},{"binary_version":"5.0.3-1","binary_name":"libpcp-mmv-perl"},{"binary_version":"5.0.3-1","binary_name":"libpcp-mmv1"},{"binary_version":"5.0.3-1","binary_name":"libpcp-pmda-perl"},{"binary_version":"5.0.3-1","binary_name":"libpcp-pmda3"},{"binary_name":"libpcp-trace2","binary_version":"5.0.3-1"},{"binary_version":"5.0.3-1","binary_name":"libpcp-web1"},{"binary_name":"libpcp3","binary_version":"5.0.3-1"},{"binary_version":"5.0.3-1","binary_name":"pcp"},{"binary_name":"pcp-conf","binary_version":"5.0.3-1"},{"binary_name":"pcp-export-pcp2graphite","binary_version":"5.0.3-1"},{"binary_version":"5.0.3-1","binary_name":"pcp-export-pcp2influxdb"},{"binary_name":"pcp-export-zabbix-agent","binary_version":"5.0.3-1"},{"binary_name":"pcp-gui","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-collectl2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-iostat2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-mrtg2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-sar2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"5.0.3-1"},{"binary_name":"pcp-manager","binary_version":"5.0.3-1"},{"binary_name":"pcp-testsuite","binary_version":"5.0.3-1"},{"binary_name":"python3-pcp","binary_version":"5.0.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.2-1","5.3.4-1","5.3.5-1","5.3.5-1build1","5.3.6-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpcp-gui2","binary_version":"5.3.6-1build1"},{"binary_name":"libpcp-import-perl","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"libpcp-import1"},{"binary_name":"libpcp-logsummary-perl","binary_version":"5.3.6-1build1"},{"binary_name":"libpcp-mmv-perl","binary_version":"5.3.6-1build1"},{"binary_name":"libpcp-mmv1","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"libpcp-pmda-perl"},{"binary_version":"5.3.6-1build1","binary_name":"libpcp-pmda3"},{"binary_name":"libpcp-trace2","binary_version":"5.3.6-1build1"},{"binary_name":"libpcp-web1","binary_version":"5.3.6-1build1"},{"binary_name":"libpcp3","binary_version":"5.3.6-1build1"},{"binary_name":"pcp","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-conf","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-export-pcp2elasticsearch"},{"binary_name":"pcp-export-pcp2graphite","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-export-pcp2influxdb"},{"binary_name":"pcp-export-pcp2json","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-export-pcp2spark","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-export-pcp2xlsx"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-export-pcp2xml"},{"binary_name":"pcp-export-pcp2zabbix","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-export-zabbix-agent","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-gui"},{"binary_name":"pcp-import-collectl2pcp","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-import-iostat2pcp"},{"binary_name":"pcp-import-mrtg2pcp","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-import-sar2pcp","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"5.3.6-1build1"},{"binary_name":"pcp-pmda-infiniband","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"pcp-testsuite"},{"binary_name":"pcp-zeroconf","binary_version":"5.3.6-1build1"},{"binary_version":"5.3.6-1build1","binary_name":"python3-pcp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.5-1","6.1.0-1","6.1.1-1","6.1.1-1build2","6.2.0-1","6.2.0-1.1build3","6.2.0-1.1build4"],"ecosystem_specific":{"binaries":[{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp-archive1t64"},{"binary_name":"libpcp-gui2t64","binary_version":"6.2.0-1.1build4"},{"binary_name":"libpcp-import-perl","binary_version":"6.2.0-1.1build4"},{"binary_name":"libpcp-import1t64","binary_version":"6.2.0-1.1build4"},{"binary_name":"libpcp-logsummary-perl","binary_version":"6.2.0-1.1build4"},{"binary_name":"libpcp-mmv-perl","binary_version":"6.2.0-1.1build4"},{"binary_name":"libpcp-mmv1t64","binary_version":"6.2.0-1.1build4"},{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp-pmda-perl"},{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp-pmda3t64"},{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp-trace2t64"},{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp-web1t64"},{"binary_version":"6.2.0-1.1build4","binary_name":"libpcp3t64"},{"binary_name":"pcp","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-conf","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-pcp2elasticsearch","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-pcp2graphite","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-pcp2influxdb","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-pcp2json","binary_version":"6.2.0-1.1build4"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-export-pcp2spark"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-export-pcp2xlsx"},{"binary_name":"pcp-export-pcp2xml","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-pcp2zabbix","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-export-zabbix-agent","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-gui","binary_version":"6.2.0-1.1build4"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-import-collectl2pcp"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-import-iostat2pcp","binary_version":"6.2.0-1.1build4"},{"binary_name":"pcp-import-mrtg2pcp","binary_version":"6.2.0-1.1build4"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-import-sar2pcp"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-import-sheet2pcp"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-pmda-infiniband"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-testsuite"},{"binary_version":"6.2.0-1.1build4","binary_name":"pcp-zeroconf"},{"binary_version":"6.2.0-1.1build4","binary_name":"python3-pcp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.3-1","6.3.8-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpcp-archive1","binary_version":"6.3.8-1"},{"binary_name":"libpcp-gui2","binary_version":"6.3.8-1"},{"binary_version":"6.3.8-1","binary_name":"libpcp-import-perl"},{"binary_version":"6.3.8-1","binary_name":"libpcp-import1"},{"binary_name":"libpcp-logsummary-perl","binary_version":"6.3.8-1"},{"binary_version":"6.3.8-1","binary_name":"libpcp-mmv-perl"},{"binary_name":"libpcp-mmv1","binary_version":"6.3.8-1"},{"binary_name":"libpcp-pmda-perl","binary_version":"6.3.8-1"},{"binary_name":"libpcp-pmda3","binary_version":"6.3.8-1"},{"binary_name":"libpcp-trace2","binary_version":"6.3.8-1"},{"binary_name":"libpcp-web1","binary_version":"6.3.8-1"},{"binary_name":"libpcp3","binary_version":"6.3.8-1"},{"binary_name":"pcp","binary_version":"6.3.8-1"},{"binary_name":"pcp-conf","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-pcp2elasticsearch","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-pcp2graphite","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-pcp2influxdb","binary_version":"6.3.8-1"},{"binary_version":"6.3.8-1","binary_name":"pcp-export-pcp2json"},{"binary_version":"6.3.8-1","binary_name":"pcp-export-pcp2spark"},{"binary_name":"pcp-export-pcp2xlsx","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-pcp2xml","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-pcp2zabbix","binary_version":"6.3.8-1"},{"binary_name":"pcp-export-zabbix-agent","binary_version":"6.3.8-1"},{"binary_name":"pcp-gui","binary_version":"6.3.8-1"},{"binary_name":"pcp-import-collectl2pcp","binary_version":"6.3.8-1"},{"binary_name":"pcp-import-ganglia2pcp","binary_version":"6.3.8-1"},{"binary_name":"pcp-import-iostat2pcp","binary_version":"6.3.8-1"},{"binary_version":"6.3.8-1","binary_name":"pcp-import-mrtg2pcp"},{"binary_name":"pcp-import-sar2pcp","binary_version":"6.3.8-1"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"6.3.8-1"},{"binary_name":"pcp-pmda-infiniband","binary_version":"6.3.8-1"},{"binary_name":"pcp-testsuite","binary_version":"6.3.8-1"},{"binary_name":"pcp-zeroconf","binary_version":"6.3.8-1"},{"binary_version":"6.3.8-1","binary_name":"python3-pcp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}},{"package":{"name":"pcp","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/pcp?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.8-1","7.0.2-1","7.1.0-1","7.1.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpcp-archive1","binary_version":"7.1.1-1"},{"binary_name":"libpcp-gui2","binary_version":"7.1.1-1"},{"binary_name":"libpcp-import-perl","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"libpcp-import1"},{"binary_name":"libpcp-logsummary-perl","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"libpcp-mmv-perl"},{"binary_version":"7.1.1-1","binary_name":"libpcp-mmv1"},{"binary_version":"7.1.1-1","binary_name":"libpcp-pmda-perl"},{"binary_name":"libpcp-pmda3","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"libpcp-trace2"},{"binary_name":"libpcp-web1","binary_version":"7.1.1-1"},{"binary_name":"libpcp3","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"libpcp4"},{"binary_version":"7.1.1-1","binary_name":"pcp"},{"binary_name":"pcp-conf","binary_version":"7.1.1-1"},{"binary_name":"pcp-export-pcp2elasticsearch","binary_version":"7.1.1-1"},{"binary_name":"pcp-export-pcp2graphite","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-export-pcp2influxdb"},{"binary_version":"7.1.1-1","binary_name":"pcp-export-pcp2json"},{"binary_name":"pcp-export-pcp2spark","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-export-pcp2xlsx"},{"binary_version":"7.1.1-1","binary_name":"pcp-export-pcp2xml"},{"binary_name":"pcp-export-pcp2zabbix","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-export-zabbix-agent"},{"binary_name":"pcp-gui","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-import-benchmarks"},{"binary_version":"7.1.1-1","binary_name":"pcp-import-collectl2pcp"},{"binary_version":"7.1.1-1","binary_name":"pcp-import-ganglia2pcp"},{"binary_name":"pcp-import-guidellm2pcp","binary_version":"7.1.1-1"},{"binary_name":"pcp-import-iostat2pcp","binary_version":"7.1.1-1"},{"binary_name":"pcp-import-mrtg2pcp","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-import-sar2pcp"},{"binary_name":"pcp-import-sheet2pcp","binary_version":"7.1.1-1"},{"binary_name":"pcp-pmda-infiniband","binary_version":"7.1.1-1"},{"binary_version":"7.1.1-1","binary_name":"pcp-testsuite"},{"binary_name":"pcp-zeroconf","binary_version":"7.1.1-1"},{"binary_name":"python3-pcp","binary_version":"7.1.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-6917.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}