[Vulnerability Report] phosphor-logging / peltool: Local Privilege Escalation via Untrusted Python Search Path

Hi OpenBMC Security Team,

I would like to report a high-severity local privilege escalation
vulnerability inside the peltool diagnostic CLI utility.

Overview of the Vulnerability:
An unprivileged local attacker can execute arbitrary code under the context
of a privileged administrator running the `peltool` utility. When executed
by root from an insecure or world-writable directory (like `/tmp`), this
leads to a full Local Privilege Escalation (LPE) and system compromise.

Affected File and Location:
File: extensions/openpower-pels/tools/peltool.cpp
Line: 226

Root Cause:
The `getPlugins` function in `peltool.cpp` explicitly appends `"."` (the
current working directory) to Python's `sys.path` search list when
initializing the embedded Python interpreter for plugin loading:
  PyObject* pResult = PyDict_GetItemString(pDict, "path");
  PyObject* pValue = PyUnicode_FromString(".");
  PyList_Append(pResult, pValue);

When `peltool` processes a Platform Event Log (PEL) record, the
`getPythonJSON` helper dynamically resolves and imports user-data parser
plugin modules based on Creator Subsystem and Component IDs. Because the
current working directory is added to the Python search path, the
interpreter will prioritize importing custom parser scripts dropped by an
attacker in the current directory over legitimate system plug-ins.

Proof of Concept:
1. An unprivileged local user creates a malicious python script in a shared
directory, such as `/tmp/udparsers/b2000/b2000.py`, defining:
   def parseUDToJson(subType, version, data):
       import os
       os.system("cp /bin/sh /tmp/sh && chmod +s /tmp/sh") # Local
Privilege Escalation Payload
2. The attacker waits for a system administrator to run `sudo peltool -a`
(or any command parsing raw PELs) while their active shell's working
directory is `/tmp`.
3. `peltool` imports the module, executes the malicious script, and creates
a SUID root shell for the attacker in `/tmp/sh`.

Proposed Patch:
Remove the current working directory `"."` from the Python path list and
strictly restrict python imports to a trusted system folder:

// Remove this block in getPlugins():
// PyObject* pValue = PyUnicode_FromString(".");
// PyList_Append(pResult, pValue);

// Enforce a trusted system-only folder instead:
PyObject* pTrustedPath =
PyUnicode_FromString("/usr/share/phosphor-logging/pels/plugins");
PyList_Append(pResult, pTrustedPath);

Legal Name for Attribution: Bhargava Naidu Gulla