Medium severity · published Jun 30, 2023
CVE-2023-29147
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced,…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Endpoint Detection And Response · Malwarebytes
through 1.0.11 · source: NVD
MA
Malwarebytes · Malwarebytes
through 1.0.14 · source: NVD
Affected product
ED
Endpoint Detection And Response
Malwarebytes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29147
Product
https://malwarebytes.com
Vendor Advisory
https://www.malwarebytes.com/secure/cves/cve-2023-29147
More from Endpoint Detection And Response
7.8
CVE-2023-29145
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution