High severity · published Jun 30, 2023
CVE-2023-29145
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Endpoint Detection And Response · Malwarebytes
through 1.0.11 · source: NVD
MA
Malwarebytes · Malwarebytes
through 1.0.14 · source: NVD
Affected product
ED
Endpoint Detection And Response
Malwarebytes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29145
Product
https://malwarebytes.com
Vendor Advisory
https://www.malwarebytes.com/secure/cves/cve-2023-29145
More from Endpoint Detection And Response
5.5
CVE-2023-29147
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced,…