CVE-2023-6917

What it actually does

Mixed privilege levels in PCP systemd services allow root-owned processes to traverse directories owned by the unprivileged PCP user, enabling symlink attacks that break intended isolation and permit local privilege escalation to root.

Why it matters to the business

Attackers who already have limited access on affected systems can obtain full administrative control, resulting in complete compromise of monitoring and performance data collection infrastructure with high urgency for patching given the long exposure window.

How an attack unfolds

An attacker with access to the PCP user account creates malicious symlinks pointing to sensitive root-owned paths inside PCP-controlled directories; when a root-privileged PCP service processes those directories it follows the symlink, allowing the attacker to overwrite or read arbitrary files and escalate to root.

How to fix it

Upgrade PCP packages to versions that enforce consistent non-root service execution and proper privilege separation; the referenced fix commit 44f28df24767cf9dca1ddc9b23157737c4cbb645 addresses the underlying service configuration issues.

How to confirm the fix worked

Verify that all PCP-related systemd units run under the dedicated PCP user/group rather than root, confirm absence of world-writable directories under PCP ownership, and test that symlink creation by the PCP user no longer affects root-owned paths.

Typical attack path

1. Obtain PCP user or group access on the target system
2. Create symlink(s) inside PCP-owned directories pointing to root-accessible resources
3. Trigger or wait for a root-privileged PCP systemd service to traverse the directory
4. Exploit the resulting file operation to read/write arbitrary files or escalate privileges

How to detect it

Review system logs for PCP service startups or directory traversals performed by root processes, inspect for unexpected symlinks created under PCP user ownership, and correlate with authentication or process creation events showing privilege transitions from the PCP account.

What your security team should do

• Immediately apply the fixed PCP package versions across all affected systems
• Audit systemd unit files for PCP services to ensure they drop privileges correctly
• Monitor for any remaining PCP processes running as root and remediate configuration drift
• Review file permissions on PCP directories to prevent symlink or TOCTOU abuse