Microsoft Defender for Endpoint Tampering Vulnerability

What is the nature of this vulnerability?
This is a client-side code vulnerability consisting of the usage of uninitialized buffer in the buffer pool by the MDE sensor on Linux systems. This affects the IP field, causing any remote connection, including failed connections, to be considered as ‘Successful remote logon’. This, in turn, triggers a false-positive alert.
All Linux machines are affected. The impact is more severe on servers which are under heavy network/login load.
The fix enforced full initialization for each buffer before use.
The fix is included in defender version 101.68.80. Customers are advised to ensure their Defender client is the latest version.

Security updates
101.68.80 — https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-updates?view=o365-worldwide