Summary: When the linux_sockets PMDA is loaded as a DSO inside PMCD, code execution
achieved via Vulnerability 3 (network.persocket.filter injection) can be escalated from user
pcp to root. The pmdarootfd Unix socket connection to pmdaroot is created without
O_CLOEXEC, causing all child processes spawned by popen() to inherit it. pmdaroot runs as
root and processes PDUROOT_STARTPMDA_REQ without per-request authentication,
executing attacker-controlled arguments via execvp() as root.
Prerequisites:
• Vulnerability 3 (linux_sockets command injection) required for initial code execution
- exploitable either locally via pmcd (TCP 44321, localhost only by default) or
remotely via the pmproxy REST API (TCP 44322, all interfaces by default, no
authentication required). linux_sockets
• PMDA loaded as DSO in PMCD (requires explicit configuration in pmcd.conf; default
is daemon mode).