CVE-2023-6917
Pcp: unsafe use of directories allows pcp to root privilege escalation
02 Description
Pcp: unsafe use of directories allows pcp to root privilege escalation
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.20% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 9.5% of scored records. A rank, not a probability.
- NVD base score
- 6.7 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2024-02-28 14:38Z2 YR AGO
- Last updated
- 2026-02-25 18:20Z8 MO AGO
- Reserved
- 2023-12-18
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.0)
- CNA CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionBase
- Data version
- 5.2
- Document digest
- 902e04b0815d4d783edff42433c112586a0e24425f073fe9501a4b1005b4a069
05 Affected products
06 References
- access.redhat.comRHSA-2024:2213https://access.redhat.com/errata/RHSA-2024:2213
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2023-6917
- bugzilla.redhat.comRHBZ#2254983https://bugzilla.redhat.com/show_bug.cgi?id=2254983
07 Fixed in
AlmaLinux 9
- pcp Fixed in 6.2.0-1.el9
- pcp-conf Fixed in 6.2.0-1.el9
- pcp-devel Fixed in 6.2.0-1.el9
- pcp-doc Fixed in 6.2.0-1.el9
- pcp-export-pcp2elasticsearch Fixed in 6.2.0-1.el9
- pcp-export-pcp2graphite Fixed in 6.2.0-1.el9
- pcp-export-pcp2influxdb Fixed in 6.2.0-1.el9
- pcp-export-pcp2json Fixed in 6.2.0-1.el9
- pcp-export-pcp2spark Fixed in 6.2.0-1.el9
- pcp-export-pcp2xml Fixed in 6.2.0-1.el9
- pcp-export-pcp2zabbix Fixed in 6.2.0-1.el9
- pcp-export-zabbix-agent Fixed in 6.2.0-1.el9
- pcp-geolocate Fixed in 6.2.0-1.el9
- pcp-gui Fixed in 6.2.0-1.el9
- pcp-import-collectl2pcp Fixed in 6.2.0-1.el9
- pcp-import-ganglia2pcp Fixed in 6.2.0-1.el9
- pcp-import-iostat2pcp Fixed in 6.2.0-1.el9
- pcp-import-mrtg2pcp Fixed in 6.2.0-1.el9
- pcp-import-sar2pcp Fixed in 6.2.0-1.el9
- pcp-libs Fixed in 6.2.0-1.el9
- pcp-libs-devel Fixed in 6.2.0-1.el9
- pcp-pmda-activemq Fixed in 6.2.0-1.el9
- pcp-pmda-apache Fixed in 6.2.0-1.el9
- pcp-pmda-bash Fixed in 6.2.0-1.el9
- pcp-pmda-bcc Fixed in 6.2.0-1.el9
- pcp-pmda-bind2 Fixed in 6.2.0-1.el9
- pcp-pmda-bonding Fixed in 6.2.0-1.el9
- pcp-pmda-bpf Fixed in 6.2.0-1.el9
- pcp-pmda-bpftrace Fixed in 6.2.0-1.el9
- pcp-pmda-cifs Fixed in 6.2.0-1.el9
- pcp-pmda-cisco Fixed in 6.2.0-1.el9
- pcp-pmda-dbping Fixed in 6.2.0-1.el9
- pcp-pmda-denki Fixed in 6.2.0-1.el9
- pcp-pmda-dm Fixed in 6.2.0-1.el9
- pcp-pmda-docker Fixed in 6.2.0-1.el9
- pcp-pmda-ds389 Fixed in 6.2.0-1.el9
- pcp-pmda-ds389log Fixed in 6.2.0-1.el9
- pcp-pmda-elasticsearch Fixed in 6.2.0-1.el9
- pcp-pmda-farm Fixed in 6.2.0-1.el9
- pcp-pmda-gfs2 Fixed in 6.2.0-1.el9
64 further packages in AlmaLinux 9 not shown (first 40 listed).
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- pcp Fixed in 6.2.0-1.el9
- pcp-conf Fixed in 6.2.0-1.el9
- pcp-devel Fixed in 6.2.0-1.el9
- pcp-doc Fixed in 6.2.0-1.el9
- pcp-export-pcp2elasticsearch Fixed in 6.2.0-1.el9
- pcp-export-pcp2graphite Fixed in 6.2.0-1.el9
- pcp-export-pcp2influxdb Fixed in 6.2.0-1.el9
- pcp-export-pcp2json Fixed in 6.2.0-1.el9
- pcp-export-pcp2spark Fixed in 6.2.0-1.el9
- pcp-export-pcp2xml Fixed in 6.2.0-1.el9
- pcp-export-pcp2zabbix Fixed in 6.2.0-1.el9
- pcp-export-zabbix-agent Fixed in 6.2.0-1.el9
- pcp-geolocate Fixed in 6.2.0-1.el9
- pcp-gui Fixed in 6.2.0-1.el9
- pcp-import-collectl2pcp Fixed in 6.2.0-1.el9
- pcp-import-ganglia2pcp Fixed in 6.2.0-1.el9
- pcp-import-iostat2pcp Fixed in 6.2.0-1.el9
- pcp-import-mrtg2pcp Fixed in 6.2.0-1.el9
- pcp-import-sar2pcp Fixed in 6.2.0-1.el9
- pcp-libs Fixed in 6.2.0-1.el9
- pcp-libs-devel Fixed in 6.2.0-1.el9
- pcp-pmda-activemq Fixed in 6.2.0-1.el9
- pcp-pmda-apache Fixed in 6.2.0-1.el9
- pcp-pmda-bash Fixed in 6.2.0-1.el9
- pcp-pmda-bcc Fixed in 6.2.0-1.el9
- pcp-pmda-bind2 Fixed in 6.2.0-1.el9
- pcp-pmda-bonding Fixed in 6.2.0-1.el9
- pcp-pmda-bpf Fixed in 6.2.0-1.el9
- pcp-pmda-bpftrace Fixed in 6.2.0-1.el9
- pcp-pmda-cifs Fixed in 6.2.0-1.el9
- pcp-pmda-cisco Fixed in 6.2.0-1.el9
- pcp-pmda-dbping Fixed in 6.2.0-1.el9
- pcp-pmda-denki Fixed in 6.2.0-1.el9
- pcp-pmda-dm Fixed in 6.2.0-1.el9
- pcp-pmda-docker Fixed in 6.2.0-1.el9
- pcp-pmda-ds389 Fixed in 6.2.0-1.el9
- pcp-pmda-ds389log Fixed in 6.2.0-1.el9
- pcp-pmda-elasticsearch Fixed in 6.2.0-1.el9
- pcp-pmda-farm Fixed in 6.2.0-1.el9
- pcp-pmda-gfs2 Fixed in 6.2.0-1.el9
64 further packages in CloudLinux 9 not shown (first 40 listed).
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- pcp No fix yet
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- pcp Fixed in 6.2.0-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 16.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 25.10
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.04 LTS
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.10
- pcp No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.