Database/Control plane, storage & DevOps
Performance Co-Pilot: root-privileged services acting on PCP-user-owned directories allow local PCP-to-root escalation
Impact
PCP ships a mix of systemd services: some run as the unprivileged pcp user/group, others as root. Where a root service writes into directories or trees owned by the pcp user, a holder of that account can break the intended privilege separation and escalate to root, typically through symlink attacks. PCP is a common fleet-wide telemetry agent, so the pcp account exists on every monitored node including GPU hosts; anyone who gets code execution as that service account - a compromised exporter, an agent plugin, a local user able to influence those paths - converts monitoring-agent access into host root. Remote access is not part of this flaw.
Who can reach it
Local attacker already holding the pcp user/group (or able to write into PCP-owned directories). High privilege required relative to an ordinary user; no network path.
What to do
Install the fixed pcp packages (RHEL: RHSA-2024:2213) and restart the PCP services - pmcd, pmlogger, pmproxy and friends - which interrupts metric collection briefly but needs no reboot. Check the Red Hat tracker for your release before scheduling.
References
Related entries
- Intel oneAPI compiler: An uncontrolled library search path: the component loads a shared library by nameCVE-2024-21857 · Intel oneAPI compilerMedium
- Intel oneAPI Level Zero software: An uncontrolled search path in Level Zero lets an authenticated local user get codeCVE-2024-31073 · Intel oneAPI Level Zero softwareMedium
- Intel oneAPI DPC++/C++ compiler: An uncontrolled library search path: the component loads a shared library by nameCVE-2024-47795 · Intel oneAPI DPC++/C++ compilerMedium
- Intel oneAPI toolkit and component installers: An uncontrolled library search path: the component loads a sharedCVE-2025-20017 · Intel oneAPI toolkit and component installersMedium
- Intel oneAPI DPC++/C++ compiler installer: The compiler installer sets permissions that let a local user modifyCVE-2025-20087 · Intel oneAPI DPC++/C++ compiler installerMedium
- Intel oneAPI DPC++/C++ compiler: An uncontrolled library search path: the component loads a shared library by nameCVE-2025-20627 · Intel oneAPI DPC++/C++ compilerMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.