CVE-2024-45770

What it actually does

The pmpost tool can execute with elevated privileges when logging messages under certain conditions, allowing privilege escalation from an already-compromised low-privileged PCP system account.

Why it matters to the business

Attackers who gain initial limited access can expand their control over the system, increasing the risk of data exposure or further compromise in environments using the affected component.

How an attack unfolds

An attacker with access to a compromised PCP system account triggers the pmpost tool under conditions that cause it to run with high-level privileges, resulting in local privilege escalation.

How to fix it

Upgrade golang.org/x/net to version 0.7.0 or later; apply vendor patches for Performance Co-Pilot to address the pmpost privilege issue.

How to confirm the fix worked

Verify the installed version of golang.org/x/net meets or exceeds 0.7.0 and confirm PCP updates have been applied through package management or configuration checks.

Typical attack path

1. Obtain access to a compromised PCP system account
2. Craft inputs or conditions to invoke pmpost
3. Trigger execution with elevated privileges to perform unauthorized actions

How to detect it

Examine system logs for unusual pmpost invocations or privilege changes originating from PCP-related accounts; review authentication and process execution history for the affected component.

What your security team should do

• Prioritize patching golang.org/x/net and PCP in all affected deployments due to the local privilege escalation risk
• Review system accounts with PCP access for signs of compromise
• Monitor for unexpected privilege changes in logging processes