CVE-2023-29146: Integer Overflow
The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value (32-bit). Attackers could create a colliding hash value for two different strings by attaching 4GB of data to a string that is less than 4GB in size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Malwarebytes EDR 1.0.11from your environment.Uninstall Malwarebytes EDR 1.0.11 on Linux or remove/disable the vulnerable component until an official patch is released.
- Compensating control
Prevent the product from processing or hashing inputs of 4 GB or larger. Implement controls to reject/quarantine or block ingestion of files >=4GB from untrusted sources (network/file shares/agents), or isolate systems that may receive such large files, until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29146?
The severity of CVE-2023-29146 is classified as high with a CVSS score of 8.2.
How do I fix CVE-2023-29146?
To fix CVE-2023-29146, you should update Malwarebytes EDR to the latest version where the vulnerability is resolved.
What type of vulnerability is CVE-2023-29146?
CVE-2023-29146 is an integer overflow vulnerability affecting the cryptographic hash calculations in Malwarebytes EDR.
What impact can CVE-2023-29146 have on my system?
CVE-2023-29146 can allow attackers to create collisions in hash values, potentially leading to security breaches.
Which software is affected by CVE-2023-29146?
CVE-2023-29146 affects Malwarebytes EDR version 1.0.11 on Linux.