Headline
CVE-2023-29147: CVE-2023-29147 - Malwarebytes EDR for Linux - Detection bypass
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
SUMMARY:
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
AFFECTED VERSIONS
- EDR for Linux <= 1.0.11
- Malwarebytes for Linux <= 1.0.14
PATCHED VERSIONS
- EDR for Linux: 1.0.56
MITIGATION ADVICE
We recommend upgrading the affected endpoints to the patched versions.
DETAILS
CWE
CVS 3.x
Vector
CWE-693: Protection Mechanism Failure
8.2 High
Local
RECOGNITION
X41-Dsec
REFERENCES
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29147