This vulnerability arises from improper validation in the sockets_check_filter() function of PCP's linux_sockets PMDA, which allows injection of shell metacharacters through the network.persocket.filter metric. When metrics refresh, these injected commands execute with the privileges of the PMDA process user. The flaw is due to inverted validation logic, enabling local attackers with low privileges to achieve arbitrary command execution. The vulnerability requires the linux_sockets PMDA to be active and the ss utility to be present, both common in typical configurations.

Successful exploitation allows a local attacker with low privileges to execute arbitrary operating system commands as the PMDA user, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. This includes unauthorized code execution, data modification, and denial of service. The attack surface is limited to systems with the linux_sockets PMDA loaded and the ss utility installed.

Red Hat advises restricting access to the pmstore utility by configuring the [access] section in /etc/pcp/pmcd/pmcd.conf and restarting the pmcd service to apply changes. Additionally, if the linux_sockets PMDA is not required, it should be unloaded or disabled to eliminate the attack vector. No official patch or fix version is currently stated; users should follow the vendor advisory for updates.