CVE-2024-3019: PCP pmproxy RCE Vulnerability

CVE-2024-3019 Overview

A flaw exists in Performance Co-Pilot (PCP) where the default pmproxy configuration exposes the Redis server backend to the local network. Attackers on an adjacent network can execute arbitrary commands with the privileges of the Redis user. The issue affects PCP versions 4.3.4 and newer. Exploitation requires pmproxy to be running, which is not the default state. Administrators typically start pmproxy from the Metrics settings page of the Cockpit web interface. The vulnerability is tracked under [CWE-668: Exposure of Resource to Wrong Sphere].

Critical Impact
Adjacent-network attackers can execute arbitrary commands as the Redis user through the exposed pmproxy Redis backend, compromising system confidentiality, integrity, and availability.

Affected Products

Performance Co-Pilot (PCP) versions 4.3.4 and newer
Red Hat Enterprise Linux distributions shipping affected PCP packages
Systems running pmproxy started via the Cockpit Metrics settings interface

Discovery Timeline

2024-03-28 - CVE-2024-3019 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3019

Vulnerability Analysis

The vulnerability resides in how pmproxy exposes its Redis backend. By default, pmproxy binds the Redis service to interfaces reachable from the local network rather than restricting access to the loopback interface. Any client on the adjacent network segment can issue Redis commands directly to the backend without authentication.

Redis exposes commands that permit writing arbitrary files and executing operations under the Redis service account. When combined with network exposure, this design allows attackers to leverage well-documented Redis abuse techniques to run commands on the host. The scope of impact aligns with the privileges of the Redis user process.

Exploitation depends on pmproxy being active. Because administrators frequently enable the service through the Cockpit web interface to visualize metrics, production monitoring hosts represent realistic targets. PCP versions prior to 4.3.4 do not carry the vulnerable default configuration.

Root Cause

The root cause is an insecure default configuration [CWE-668]. pmproxy publishes the Redis backend beyond the trust boundary it should occupy, granting adjacent network clients access to a service that must remain local or authenticated.

Attack Vector

The attack vector is adjacent network. An attacker with access to the same broadcast domain or logical network as the target sends crafted Redis protocol commands to the exposed pmproxy Redis port. No authentication or user interaction is required. Successful command execution runs with the Redis account's privileges.

No verified public exploit code is available for this issue. Refer to the Red Hat CVE-2024-3019 Security Information and Red Hat Bugzilla Entry #2271898 for authoritative technical details.

Detection Methods for CVE-2024-3019

Indicators of Compromise

Unexpected Redis command traffic reaching pmproxy hosts from non-local addresses
New or modified files owned by the Redis user in unexpected locations such as cron directories or SSH authorized_keys paths
Child processes spawned by the Redis or pmproxy service accounts that execute shells, interpreters, or download utilities
pmproxy running on hosts where metrics forwarding is not an operational requirement

Detection Strategies

Inventory hosts where pmproxy is active and validate whether the service is required for operations
Monitor network flows for Redis protocol traffic (default port 6379 and pmproxy port 44322) crossing subnet boundaries
Alert on process lineage where the Redis user account launches interactive shells or scripting engines
Correlate Cockpit configuration changes that enable the Metrics settings with subsequent pmproxy activation

Monitoring Recommendations

Enable and forward PCP, pmproxy, and Redis logs to a centralized analytics platform
Track file integrity for Redis-writable directories and any location the Redis user can reach
Baseline outbound connections from monitoring hosts and alert on deviations
Review firewall telemetry for connections to pmproxy and Redis ports from unexpected sources

How to Mitigate CVE-2024-3019

Immediate Actions Required

Apply the vendor-supplied PCP updates referenced in the Red Hat advisories, including RHSA-2024:2566 and RHSA-2024:3264
Stop pmproxy on hosts where it is not required and disable it from starting via Cockpit
Restrict network access to pmproxy and Redis ports using host firewalls or network ACLs
Audit Cockpit Metrics settings changes across managed hosts

Patch Information

Red Hat has issued multiple errata addressing CVE-2024-3019 across supported product streams. Consult RHSA-2024:3321, RHSA-2024:3322, RHSA-2024:3323, RHSA-2024:3324, RHSA-2024:3325, and RHSA-2024:3392 for stream-specific fixed package versions and installation instructions.

Workarounds

Do not start pmproxy unless metrics forwarding to Redis is explicitly required
Bind pmproxy and Redis to the loopback interface where the workflow permits it
Enforce host-based firewall rules that restrict pmproxy and Redis ports to trusted management hosts
Segment monitoring infrastructure onto a dedicated management network isolated from user subnets

bash

# Configuration example
# Refer to Red Hat advisories for authoritative remediation steps