CVE-2023-29144
📋 TL;DR
Malwarebytes 1.0.14 for Linux has a signature computation vulnerability that allows malware to bypass detection. This affects Linux systems running this specific version of Malwarebytes antivirus software.
💻 Affected Systems
- Malwarebytes for Linux
📦 What is this software?
Malwarebytes by Malwarebytes
⚠️ Risk & Real-World Impact
Worst Case
Malware executes undetected, leading to system compromise, data theft, or ransomware infection.
Likely Case
Targeted malware evades detection, potentially causing data exfiltration or persistence on affected systems.
If Mitigated
Limited impact due to layered security controls, network segmentation, and regular system monitoring.
🎯 Exploit Status
Exploitation requires malware to be present on the system and specifically crafted to bypass signature detection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.15 or later
Vendor Advisory: https://www.malwarebytes.com/secure/cves/cve-2023-29144
Restart Required: Yes
Instructions:
1. Update Malwarebytes using your package manager. 2. For Ubuntu/Debian: sudo apt update && sudo apt upgrade malwarebytes. 3. For RHEL/CentOS: sudo yum update malwarebytes. 4. Restart the Malwarebytes service: sudo systemctl restart malwarebytes.
🔧 Temporary Workarounds
Disable Malwarebytes temporarily
linuxStop Malwarebytes service to prevent false sense of security while vulnerable
sudo systemctl stop malwarebytes
Use alternative antivirus
linuxTemporarily deploy another antivirus solution while vulnerable
🧯 If You Can't Patch
- Implement network segmentation to limit spread of potential malware
- Enable additional endpoint detection and response (EDR) tools
🔍 How to Verify
Check if Vulnerable:
Check Malwarebytes version: malwarebytes --versionCheck Version:
malwarebytes --versionVerify Fix Applied:
Verify version is 1.0.15 or later: malwarebytes --version📡 Detection & Monitoring
Log Indicators:
- Failed malware detections
- Unusual process executions bypassing antivirus
Network Indicators:
- Unexpected outbound connections from systems with Malwarebytes
SIEM Query:
source="malwarebytes" AND (event="scan_failed" OR event="bypass_detected")