Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.
References
| Link | Resource |
|---|---|
| https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250 | Third Party Advisory |
| https://unity3d.com | Product |
| https://www.kb.cert.org/vuls/id/287122 | Third Party Advisory US Government Resource |
Configurations
History
25 Aug 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Unity
Unity parsec |
|
| CWE | CWE-367 | |
| CPE | cpe:2.3:a:unity:parsec:*:*:*:*:*:*:*:* | |
| References | (CONFIRM) https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250 - Third Party Advisory | |
| References | (MISC) https://unity3d.com - Product | |
| References | (MISC) https://www.kb.cert.org/vuls/id/287122 - Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
21 Aug 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-20 08:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-37250
Mitre link : CVE-2023-37250
CVE.ORG link : CVE-2023-37250
JSON object : View
Products Affected
unity
- parsec
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition