Anolis OS update for pcp

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU96640

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-6917

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application uses mixed privilege levels utilized by systemd services associated with PCP. A local user can escalate privileges on the system via symlink attacks.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 23

pcp-pmda-mssql: before 6.2.0-1

python3-pcp: before 6.2.0-1

perl-PCP-PMDA: before 6.2.0-1

perl-PCP-MMV: before 6.2.0-1

perl-PCP-LogSummary: before 6.2.0-1

perl-PCP-LogImport: before 6.2.0-1

pcp-zeroconf: before 6.2.0-1

pcp-testsuite: before 6.2.0-1

pcp-system-tools: before 6.2.0-1

pcp-selinux: before 6.2.0-1

pcp-pmda-zswap: before 6.2.0-1

pcp-pmda-zimbra: before 6.2.0-1

pcp-pmda-weblog: before 6.2.0-1

pcp-pmda-unbound: before 6.2.0-1

pcp-pmda-trace: before 6.2.0-1

pcp-pmda-systemd: before 6.2.0-1

pcp-pmda-summary: before 6.2.0-1

pcp-pmda-sockets: before 6.2.0-1

pcp-pmda-snmp: before 6.2.0-1

pcp-pmda-smart: before 6.2.0-1

pcp-pmda-slurm: before 6.2.0-1

pcp-pmda-shping: before 6.2.0-1

pcp-pmda-sendmail: before 6.2.0-1

pcp-pmda-samba: before 6.2.0-1

pcp-pmda-rsyslog: before 6.2.0-1

pcp-pmda-roomtemp: before 6.2.0-1

pcp-pmda-redis: before 6.2.0-1

pcp-pmda-rabbitmq: before 6.2.0-1

pcp-pmda-postgresql: before 6.2.0-1

pcp-pmda-postfix: before 6.2.0-1

pcp-pmda-podman: before 6.2.0-1

pcp-pmda-perfevent: before 6.2.0-1

pcp-pmda-pdns: before 6.2.0-1

pcp-pmda-oracle: before 6.2.0-1

pcp-pmda-openvswitch: before 6.2.0-1

pcp-pmda-openmetrics: before 6.2.0-1

pcp-pmda-nvidia-gpu: before 6.2.0-1

pcp-pmda-nutcracker: before 6.2.0-1

pcp-pmda-nginx: before 6.2.0-1

pcp-pmda-nfsclient: before 6.2.0-1

pcp-pmda-news: before 6.2.0-1

pcp-pmda-netfilter: before 6.2.0-1

pcp-pmda-netcheck: before 6.2.0-1

pcp-pmda-named: before 6.2.0-1

pcp-pmda-mysql: before 6.2.0-1

pcp-pmda-mounts: before 6.2.0-1

pcp-pmda-mic: before 6.2.0-1

pcp-pmda-memcache: before 6.2.0-1

pcp-pmda-mailq: before 6.2.0-1

pcp-pmda-lustrecomm: before 6.2.0-1

pcp-pmda-lustre: before 6.2.0-1

pcp-pmda-logger: before 6.2.0-1

pcp-pmda-lmsensors: before 6.2.0-1

pcp-pmda-lio: before 6.2.0-1

pcp-pmda-libvirt: before 6.2.0-1

pcp-pmda-json: before 6.2.0-1

pcp-pmda-infiniband: before 6.2.0-1

pcp-pmda-haproxy: before 6.2.0-1

pcp-pmda-hacluster: before 6.2.0-1

pcp-pmda-gpsd: before 6.2.0-1

pcp-pmda-gpfs: before 6.2.0-1

pcp-pmda-gluster: before 6.2.0-1

pcp-pmda-gfs2: before 6.2.0-1

pcp-pmda-elasticsearch: before 6.2.0-1

pcp-pmda-ds389log: before 6.2.0-1

pcp-pmda-ds389: before 6.2.0-1

pcp-pmda-docker: before 6.2.0-1

pcp-pmda-dm: before 6.2.0-1

pcp-pmda-denki: before 6.2.0-1

pcp-pmda-dbping: before 6.2.0-1

pcp-pmda-cisco: before 6.2.0-1

pcp-pmda-cifs: before 6.2.0-1

pcp-pmda-bpftrace: before 6.2.0-1

pcp-pmda-bonding: before 6.2.0-1

pcp-pmda-bind2: before 6.2.0-1

pcp-pmda-bcc: before 6.2.0-1

pcp-pmda-bash: before 6.2.0-1

pcp-pmda-apache: before 6.2.0-1

pcp-pmda-activemq: before 6.2.0-1

pcp-libs-devel: before 6.2.0-1

pcp-libs: before 6.2.0-1

pcp-import-sar2pcp: before 6.2.0-1

pcp-import-mrtg2pcp: before 6.2.0-1

pcp-import-iostat2pcp: before 6.2.0-1

pcp-import-ganglia2pcp: before 6.2.0-1

pcp-import-collectl2pcp: before 6.2.0-1

pcp-gui: before 6.2.0-1

pcp-export-zabbix-agent: before 6.2.0-1

pcp-export-pcp2zabbix: before 6.2.0-1

pcp-export-pcp2xml: before 6.2.0-1

pcp-export-pcp2spark: before 6.2.0-1

pcp-export-pcp2json: before 6.2.0-1

pcp-export-pcp2influxdb: before 6.2.0-1

pcp-export-pcp2graphite: before 6.2.0-1

pcp-export-pcp2elasticsearch: before 6.2.0-1

pcp-doc: before 6.2.0-1

pcp-devel: before 6.2.0-1

pcp-conf: before 6.2.0-1

pcp: before 6.2.0-1

CPE2.3

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:o:openanolis:pcp-pmda-mssql:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:python3-pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:perl-pcp-pmda:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:perl-pcp-mmv:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:perl-pcp-logsummary:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:perl-pcp-logimport:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-zeroconf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-testsuite:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-system-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-selinux:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-zswap:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-zimbra:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-weblog:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-unbound:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-trace:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-systemd:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-summary:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-sockets:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-snmp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-smart:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-slurm:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-shping:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-sendmail:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-samba:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-rsyslog:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-roomtemp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-redis:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-rabbitmq:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-postgresql:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-postfix:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-podman:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-perfevent:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-pdns:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-oracle:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-openvswitch:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-openmetrics:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-nvidia-gpu:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-nutcracker:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-nginx:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-nfsclient:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-news:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-netfilter:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-netcheck:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-named:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-mysql:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-mounts:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-mic:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-memcache:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-mailq:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-lustrecomm:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-lustre:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-logger:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-lmsensors:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-lio:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-libvirt:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-json:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-infiniband:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-haproxy:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-hacluster:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-gpsd:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-gpfs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-gluster:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-gfs2:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-elasticsearch:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-ds389log:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-ds389:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-docker:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-dm:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-denki:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-dbping:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-cisco:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-cifs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-bpftrace:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-bonding:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-bind2:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-bcc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-bash:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-apache:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-pmda-activemq:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-import-sar2pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-import-mrtg2pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-import-iostat2pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-import-ganglia2pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-import-collectl2pcp:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-gui:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-zabbix-agent:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2zabbix:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2xml:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2spark:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2json:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2influxdb:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2graphite:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-export-pcp2elasticsearch:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp-conf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:pcp:*:*:*:*:*:anolis_os:*:*

External links

https://anas.openanolis.cn/errata/detail/ANSA-2024:0579

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.