Vulnerability in ClamAV Regex Module
Summary
CVE-2022-20792: A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local at... Affects clamav across 3 version ranges.
< 0.103.6-r0
< 5faab1937cc2b89049ef7748dc9a10545707613d
>= ba51bf8e644921a1592d2f3d280a2daa924acfd8, <= fb828e93cab6b73818c1d94ffd05d92720a85c6f
Fixed in 0.103.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Clam AntiVirus (ClamAV) is an open-source antivirus engine designed for detecting malicious software. It is commonly used to scan files and emails for potential threats. The regex module is a component of ClamAV that is responsible for handling regular expressions used in the signature database load module. This module allows ClamAV to identify specific patterns and signatures associated with known malware. However, a vulnerability has been discovered in the regex module that could be exploited by an authenticated, local attacker.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20792, exists in ClamAV versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior. It is caused by improper bounds checking in the regex module, leading to a multi-byte heap buffer overflow write. An attacker with local access and authentication can exploit this vulnerability by placing a crafted CDB ClamAV signature database file in the ClamAV database directory. This exploit has the potential to crash ClamAV during database load time and may even allow the attacker to execute arbitrary code with the privileges of the 'clamav' user.
How To Fix
Minimum fixed version
0.103.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating ClamAV to the latest version.
Conclusion
In conclusion, the vulnerability in the regex module of ClamAV can be exploited by an authenticated, local attacker to crash the antivirus engine and potentially execute arbitrary code. It is crucial to update ClamAV to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus engine used for detecting malicious software.
The regex module is responsible for handling regular expressions used in the signature database load module of ClamAV.
An attacker with local access and authentication can exploit this vulnerability by placing a crafted CDB ClamAV signature database file in the ClamAV database directory.
This vulnerability can crash ClamAV during database load time and may allow an attacker to execute arbitrary code with the privileges of the 'clamav' user.
To protect against this vulnerability, it is recommended to update ClamAV to version 0.103.6-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
