Symbolic Link Manipulation Vulnerability in Trellix Anti-Malware Engine

CVE-2024-0206

Summary

A vulnerability in Trellix Anti-Malware Engine allows an authenticated local user to manipulate symbolic links, potentially leading to privilege escalation. By creating a registry entry under the Trellix ENS registry folder that links to files outside their usual permission scope, a local user could exploit this flaw. When a scan is executed, the Engine follows these symbolic links, allowing unauthorized access to remove critical files that the user typically cannot access. This exploitation risk underscores the importance of monitoring user privileges and applying the latest updates to the software.

References