CVE-2026-16530: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-16530 is an out-of-bounds read vulnerability in the PCP (Performance Co-Pilot) pmproxy service, specifically within the pmLogLoadInDom() function. A remote, unauthenticated attacker can send a specially crafted request to bypass a critical bounds check, causing the pmproxy service to crash (Denial of Service) or leak sensitive information from heap memory. Affected products include the pcp package on Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4 (via rhcos); RHEL 6 and 7 status is listed as unknown. The vulnerability was published on July 30, 2026, with a CVSS v3.1 base score of 6.5 (Medium), assigned by Red Hat (Red Hat CVE, GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the __pmLogLoadInDom() function. A bounds check that prevents a string index (idx) from exceeding the buffer is guarded by if (acp != NULL), but in the streaming path used by the logger servlet (POST /logger/meta), acp is always NULL (hardcoded at the call site), meaning the check never executes. An attacker can submit a TYPE_INDOM record with an arbitrary idx value, causing namelist[i] to point to an arbitrary heap offset, which is subsequently dereferenced by strlen/strdup in the caller — triggering a crash or enabling heap information leakage. Exploitation requires only that pmproxy is reachable on TCP port 44322 (default) and a valid archive ID obtained from a prior unauthenticated POST /logger/label request (Red Hat Bugzilla).

Successful exploitation can cause the pmproxy service to crash, resulting in a Denial of Service that disrupts performance monitoring capabilities on affected systems. Additionally, the out-of-bounds read may expose sensitive data from heap memory, creating a risk of information leakage. The CVSS scoring reflects low integrity and low availability impact with no confidentiality impact formally scored, though the heap leakage risk represents a practical confidentiality concern (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify hosts running pmproxy (PCP) with TCP port 44322 open using network scanning tools such as Nmap (nmap -p 44322 <target>) or internet-wide scanners like Shodan.
2. Obtain a valid archive ID: Send an unauthenticated POST /logger/label HTTP request to the pmproxy service to retrieve a valid archive ID — no credentials are required for this step.
3. Craft a malicious TYPE_INDOM record: Construct a POST /logger/meta request containing a TYPE_INDOM record with an arbitrary, out-of-bounds idx value designed to point namelist[i] to a target heap offset.
4. Send the crafted request: Submit the malicious request to pmproxy on TCP port 44322. Because acp is always NULL in this code path, the bounds check is skipped entirely.
5. Achieve DoS or heap leak: The strlen/strdup call dereferences the attacker-controlled pointer, either crashing the pmproxy process (DoS) or returning heap memory contents that may contain sensitive information (Red Hat Bugzilla).

• Network: Unexpected or repeated POST requests to /logger/meta and /logger/label endpoints on TCP port 44322 from external or untrusted IP addresses; anomalous traffic patterns targeting pmproxy.
• Logs: pmproxy service logs showing crashes, segmentation faults, or abrupt restarts; HTTP access logs recording POST /logger/meta requests with unusually large or malformed body content.
• Process: Unexpected termination or restart of the pmproxy process; core dump files generated in the PCP working directory following a crash.

Red Hat has acknowledged the vulnerability and a patch is noted as available (patch details reference the Red Hat Bugzilla entry dated July 29–30, 2026); administrators should apply updated pcp packages for RHEL 8, 9, 10, and RHCOS as soon as they are released via Red Hat's package repositories (Red Hat CVE, Red Hat Bugzilla). As an interim workaround, restrict network access to TCP port 44322 using firewall rules to limit exposure to trusted hosts only. If pmproxy is not required, consider disabling the service until a patch can be applied.