CVE-2020-25533 Race condition in n/a

High 7.0 Published 15 Jan 2021 Updated 4 Aug 2024

A race condition in Malwarebytes for macOS allows attackers to bypass XPC validation and execute privileged actions via PID reuse.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-25533?

CVE-2020-25533 is a high-severity vulnerability in n/a, published on 15 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn.

Weakness: CWE-362

Which versions are affected by CVE-2020-25533?

It affects 1 product.

Products include Malwarebytes Malwarebytes.

How do I fix CVE-2020-25533?

No fix has been published for CVE-2020-25533 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-25533 being exploited?

There is no known exploitation of CVE-2020-25533 in the wild and no public exploit code.

Sources

Also known as GHSA-p523-j8f3-523j.