CVE-2022-2735 — Incorrect Default Permissions in PCS

CWE-276 — Incorrect Default Permissions8 documents7 sources
Severity
7.8HIGHNVD
OSV6.1
EPSS
0.0%
top 86.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Clusterlabs PCSDebian Linux
Timeline
PublishedSep 6
Latest updateJul 2

Description

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw allows an attacker to have complete control over the cluster managed by PCS.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Debianclusterlabs/pcs< 0.10.8-1+deb11u1+3
▶Ubuntuclusterlabs/pcs< 0.9.149-1ubuntu1.1+esm1+2
▶NVDclusterlabs/pcs0.10.5 — 0.11.3
▶CVEListV5clusterlabs/pcsAffects v0.10.5 and later including all 0.11.x.

Also affects: Debian Linux 11.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
OSV
pcs vulnerabilities↗2025-07-02
▶
GHSA
GHSA-7xr9-rmm4-cq6v: A vulnerability was found in the PCS project↗2022-09-07
▶
CVEList
CVE-2022-2735: A vulnerability was found in the PCS project↗2022-09-06
▶
OSV
CVE-2022-2735: A vulnerability was found in the PCS project↗2022-09-06
▶

📋Vendor Advisories

3
Ubuntu
pcs vulnerabilities↗2025-07-02
▶
Red Hat
pcs: obtaining an authentication token for hacluster user could lead to privilege escalation↗2022-09-01
▶
Debian
CVE-2022-2735: pcs - A vulnerability was found in the PCS project. This issue occurs due to incorrect...↗2022
▶
CVE-2022-2735 — Incorrect Default Permissions in PCS | cvebase