CVE-2023-37250: Race Condition
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37250?
CVE-2023-37250 is considered a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2023-37250?
To fix CVE-2023-37250, update Unity Parsec to the latest version beyond 9.0.
What types of attacks are possible with CVE-2023-37250?
CVE-2023-37250 allows local attackers to escalate privileges to SYSTEM on affected systems.
Which versions of Unity Parsec are affected by CVE-2023-37250?
CVE-2023-37250 affects Unity Parsec versions prior to 9.0 installed in 'Per User' mode.
What is a TOCTOU race condition in the context of CVE-2023-37250?
In CVE-2023-37250, a TOCTOU race condition occurs when the application improperly validates DLL integrity due to timing issues during execution.