Bypass Record
Exploitation for Priv-Esc × Trellix Agent for Linux
A publicly-reported instance of Exploitation for Priv-Esc bypassing Trellix Agent for Linux, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The Trellix Agent service, running as root, fails to validate input size when reading from files, leading to a classic buffer overflow (CWE-120). An attacker with local access can craft oversized input to corrupt memory, potentially executing arbitrary code with root privileges or crashing the service.
Detection & mitigation
Monitor for unexpected child processes spawned by the Trellix Agent service (e.g., via process creation logs with parent process name 'maconfig' or 'macmnsvc') and for abnormal file writes to agent configuration directories. Mitigate by applying the vendor patch (version 5.8.1 or later) and restricting local access to the agent's file paths.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.