CVE-2020-25533

An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn.

CVSS v3.1

7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2021-01-15

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/

References

• CVE Record
• NVD entry

Related

• CVE-2020-25516
• CVE-2020-25538
• CVE-2020-2551
• CVE-2020-25540
• CVE-2020-25507
• CVE-2020-2555