CVE catalog

CVE-2023-6917

pcp: CVE-2023-6917

Severity: Medium · CVSS 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 27, 2026

A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pcp	sid	`7.2.2-1`	fixed
Debian	pcp	trixie	`6.3.8-1`	fixed
Debian	pcp	bookworm	`6.0.3-1.1`	vulnerable
Suse	pcp	linux micro 6.1	`6.2.0-slfo.1.1_3.1`	fixed
Suse	pcp	linux micro 6.0	`6.2.0-1.1`	fixed
Suse	pcp	linux enterprise module for development tools 15 sp6	`6.2.0-150600.3.6.1`	fixed
Opensuse	pcp	leap 15.6	`6.2.0-150600.3.6.1`	fixed
Suse	pcp	linux enterprise software development kit 12 sp5	`6.2.0-6.29.2`	fixed
Suse	pcp	linux enterprise module for development tools 15 sp5	`6.2.0-150500.8.6.1`	fixed
Opensuse	pcp	leap 15.5	`6.2.0-150500.8.6.1`	fixed
Suse	pcp	linux enterprise high performance computing 15 sp4-espos	`6.2.0-150400.5.12.3`	fixed
Suse	pcp	linux enterprise high performance computing 15 sp4-ltss	`6.2.0-150400.5.12.3`	fixed
Suse	pcp	linux enterprise server 15 sp4-ltss	`6.2.0-150400.5.12.3`	fixed
Suse	pcp	linux enterprise server for sap applications 15 sp4	`6.2.0-150400.5.12.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pcp	source	sid	`6.2.0-1`	not yet assigned	Not reported	Not reported
Debian	pcp	source	trixie	`6.2.0-1`	not yet assigned	Not reported	Not reported
Debian	pcp	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Suse	pcp	rpm	linux micro 6.1	`6.2.0-slfo.1.1_3.1`	Not reported	SUSE-SU-2025:20235-1	Not reported
Suse	pcp	rpm	linux micro 6.0	`6.2.0-1.1`	Not reported	SUSE-SU-2025:20133-1	Not reported
Suse	pcp	rpm	linux enterprise module for development tools 15 sp6	`6.2.0-150600.3.6.1`	Not reported	SUSE-SU-2024:3533-1	Not reported
Opensuse	pcp	rpm	leap 15.6	`6.2.0-150600.3.6.1`	Not reported	SUSE-SU-2024:3533-1	Not reported
Suse	pcp	rpm	linux enterprise software development kit 12 sp5	`6.2.0-6.29.2`	Not reported	SUSE-SU-2024:3976-1	Not reported
Suse	pcp	rpm	linux enterprise module for development tools 15 sp5	`6.2.0-150500.8.6.1`	Not reported	SUSE-SU-2024:3785-1	Not reported
Opensuse	pcp	rpm	leap 15.5	`6.2.0-150500.8.6.1`	Not reported	SUSE-SU-2024:3785-1	Not reported
Suse	pcp	rpm	linux enterprise high performance computing 15 sp4-espos	`6.2.0-150400.5.12.3`	Not reported	SUSE-SU-2025:0801-1	Not reported
Suse	pcp	rpm	linux enterprise high performance computing 15 sp4-ltss	`6.2.0-150400.5.12.3`	Not reported	SUSE-SU-2025:0801-1	Not reported
Suse	pcp	rpm	linux enterprise server 15 sp4-ltss	`6.2.0-150400.5.12.3`	Not reported	SUSE-SU-2025:0801-1	Not reported
Suse	pcp	rpm	linux enterprise server for sap applications 15 sp4	`6.2.0-150400.5.12.3`	Not reported	SUSE-SU-2025:0801-1	Not reported

Notes

[bookworm] pcp: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libpcp3]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp3-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-archive1]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-archive1-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-gui2]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-gui2-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-import1]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-import1-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-import-perl]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-logsummary-perl]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-mmv1]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-mmv1-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-mmv-perl]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-pmda3]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-pmda3-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-pmda-perl]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-trace2]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-trace2-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-web1]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
[libpcp-web1-dev]Affected
Source package: [pcp]
Details (2)
- 6.0.3-1.1 · amd64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12
- 6.0.3-1.1 · arm64 · bookworm
  Affected
  dsa · pcp · debian · bookworm; dsa · pcp · debian · 12

Next results

Observed: Oct 28, 2026, 6:14:08 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]