PT-2023-22169 · Malwarebytes · Malwarebytes Edr

Published 2023-06-30 · Updated 2024-11-26 · CVE-2023-29145

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Malwarebytes EDR version 1.0.11 for Linux

Description The Malwarebytes EDR for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. An attacker can exploit this by setting LD LIBRARY PATH, setting LD PRELOAD, or running an executable file in a debugger.

Recommendations For Malwarebytes EDR version 1.0.11 for Linux, as a temporary workaround, consider restricting the use of the vulnerable driver until a patch is available. Avoid setting LD LIBRARY PATH or LD PRELOAD to minimize the risk of exploitation. Restrict access to the debugger for executable files to prevent potential attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-29145

Affected Products

Malwarebytes Edr

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-29145 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29145 · Vendor Advisory
• https://malwarebytes.com/secure/cves/cve-2023-29145 · Vendor Advisory
• https://t.me/cvenotify/53446 · Telegram Post
• https://t.me/cvenotify/102612 · Telegram Post
• https://t.me/cibsecurity/65828 · Telegram Post
• https://malwarebytes.com · Note