CVE-2023-6917

A vulnerability has been identified in the Performance Co-Pilot (PCP)
package, stemming from the mixed privilege levels utilized by systemd
services associated with PCP. While certain services operate within the
confines of limited PCP user/group privileges, others are granted full root
privileges. This disparity in privilege levels poses a risk when privileged
root processes interact with directories or directory trees owned by
unprivileged PCP users. Specifically, this vulnerability may lead to the
compromise of PCP user isolation and facilitate local PCP-to-root exploits,
particularly through symlink attacks. These vulnerabilities underscore the
importance of maintaining robust privilege separation mechanisms within PCP
to mitigate the potential for unauthorized privilege escalation.