CVE-2023-29147 – Malwarebytes
EDR for Linux – Detection bypass
SUMMARY:
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.
AFFECTED VERSIONS
- EDR for Linux <= 1.0.11
- Malwarebytes for Linux <= 1.0.14
PATCHED VERSIONS
- EDR for Linux: 1.0.56
MITIGATION ADVICE
We recommend upgrading the affected endpoints to the patched versions.
DETAILS
| CWE | CVS 3.x | Vector |
| CWE-693: Protection Mechanism Failure | 8.2 High | Local |