Command Injection in PCP Linux Sockets PMDA

Executive Summary

CVE-2026-16524 is a command injection flaw in PCP's linux_sockets PMDA. It occurs due to improper validation in the sockets_check_filter() function, which incorrectly handles safe and malicious inputs. Attackers can exploit this by injecting shell metacharacters via the network.persocket.filter metric, leading to arbitrary command execution as the PMDA user when metrics refresh.

Useful 0 Not Useful 0

Detection Guidance

Check if the linux_sockets PMDA is loaded by running pminfo -a. Verify if the ss binary exists on the system. Inspect pmcd.conf for restrictions on pmstore access. Monitor for unusual command execution patterns in PMDA logs or system logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system as the PMDA user. To exploit it, an attacker needs access to the network.persocket.filter metric, the linux_sockets PMDA loaded, and the ss binary present. Successful exploitation could lead to unauthorized system access, data theft, or further compromise depending on the PMDA user's privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized command execution. If exploited, attackers could gain control over the PMDA process user, leading to unauthorized data access, modification, or exfiltration. GDPR requires protection against unauthorized processing, while HIPAA mandates safeguards for sensitive health data. The flaw undermines these requirements by enabling arbitrary command execution.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the linux_sockets PMDA if not required. Restrict pmstore access in pmcd.conf by adding appropriate controls. Update PCP to the latest patched version if available. Monitor for suspicious activity in PMDA processes.

Useful 0 Not Useful 0