CVE-2024-3019: PCP pmproxy RCE Vulnerability

CVE-2024-3019 Overview

CVE-2024-3019 is a security flaw in Performance Co-Pilot (PCP) where the default pmproxy configuration exposes the Redis server backend to the local network. This exposure allows remote command execution with the privileges of the Redis user. The vulnerability affects PCP versions 4.3.4 and newer. Exploitation requires that pmproxy be running, which is not the default state. Administrators typically start pmproxy from the Metrics settings page of the Cockpit web interface. The flaw is categorized under [CWE-668] (Exposure of Resource to Wrong Sphere) and is exploitable from an adjacent network position.

Critical Impact
Attackers on the adjacent network can execute arbitrary commands with Redis user privileges when pmproxy is running, leading to full compromise of the Redis backend and hosted metrics data.

Affected Products

Performance Co-Pilot (PCP) 4.3.4 and newer
Red Hat Enterprise Linux distributions shipping affected PCP packages
Systems where pmproxy has been enabled via Cockpit Metrics settings

Discovery Timeline

2024-03-28 - CVE-2024-3019 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3019

Vulnerability Analysis

PCP is a framework and services for monitoring system-level performance metrics. The pmproxy daemon acts as a proxy between PCP clients and back-end services, including a Redis instance used for time-series metric storage. In the default configuration, pmproxy binds to network interfaces reachable from the local network rather than restricting access to loopback. This exposure permits any host on the adjacent network to send Redis protocol commands through the proxy. Because Redis executes commands with the privileges of the Redis user, an attacker can leverage Redis features to write files, load modules, or otherwise achieve command execution on the host. The flaw is a configuration and exposure defect rather than a code-level memory issue.

Root Cause

The root cause is an insecure default configuration in pmproxy that exposes the Redis backend to the local network segment. PCP does not enforce authentication or network scoping between the proxy and Redis by default. This falls under [CWE-668] Exposure of Resource to Wrong Sphere. See the Red Hat CVE Analysis for CVE-2024-3019 for vendor detail.

Attack Vector

An attacker positioned on the same broadcast domain or otherwise adjacent network reaches the exposed pmproxy listener and issues Redis commands through the proxy channel. No authentication or user interaction is required. The attacker abuses standard Redis primitives to stage payloads and achieve execution as the Redis user account. Exploitation is contingent on pmproxy being started, which happens when administrators enable metrics via Cockpit. See the Red Hat Bugzilla Report #2271898 for reproduction context.

No verified public exploit code is available. The vulnerability mechanism is described in prose per Red Hat's advisory materials.

Detection Methods for CVE-2024-3019

Indicators of Compromise

Unexpected pmproxy processes listening on non-loopback interfaces on TCP port 44322
Redis processes writing files outside of standard data directories or loading unexpected modules
Outbound network connections initiated by the Redis user account to attacker-controlled hosts
New cron entries, SSH authorized keys, or shell scripts owned by the Redis user

Detection Strategies

Audit running services on PCP hosts to confirm whether pmproxy is enabled and which interfaces it binds to.
Monitor for Redis protocol traffic (CONFIG SET, MODULE LOAD, SLAVEOF) reaching PCP hosts from unexpected source addresses.
Correlate process creation events where the Redis user spawns shells, interpreters, or network utilities.

Monitoring Recommendations

Enable auditd rules on /etc/pcp, /var/lib/pcp, and Redis working directories to record write events.
Ingest PCP and pmproxy logs into a central logging platform and alert on configuration reload events.
Baseline expected Cockpit Metrics activations and alert on unexpected enablement across managed hosts.

How to Mitigate CVE-2024-3019

Immediate Actions Required

Apply the PCP updates referenced in the Red Hat security advisories, including RHSA-2024:2566 and follow-up errata RHSA-2024:3264, RHSA-2024:3321 through RHSA-2024:3325, and RHSA-2024:3392.
Stop and disable pmproxy on hosts that do not require remote metrics proxying.
Restrict network access to PCP hosts using host-based firewalls until patches are applied.

Patch Information

Red Hat has released patched PCP packages across supported Red Hat Enterprise Linux versions. Refer to the Red Hat CVE Analysis for CVE-2024-3019 for the complete package matrix. After patching, verify that pmproxy binds only to authorized interfaces and that Redis is not reachable from untrusted networks.

Workarounds

Do not start pmproxy unless required; the default disabled state prevents exploitation.
Configure host firewalls (firewalld or nftables) to block inbound access to the pmproxy port from untrusted networks.
Bind Redis and pmproxy explicitly to 127.0.0.1 where local-only metrics collection is sufficient.

bash

# Configuration example: disable pmproxy and block the port with firewalld
sudo systemctl stop pmproxy
sudo systemctl disable pmproxy
sudo firewall-cmd --permanent --remove-service=pmproxy 2>/dev/null || true
sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' port port='44322' protocol='tcp' reject"
sudo firewall-cmd --reload