CVE-2020-25533

Katalog CVE

CVSS 7.0 · High EPSS 0,27%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada malwarebytes. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn.

Rincian

Terbit di NVD

15 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/ exploit · patch · advisory pihak ketiga