CISCO: ClamAV Heap Buffer Overflow

### Summary A heap buffer overflow can be triggered in [ClamAV](https://github.com/Cisco-Talos/clamav)’s [HFSPlus](https://en.wikipedia.org/wiki/HFS_Plus) file-system parsing. The root-issue is a missing size check when copying blocks to a node buffer. ### Severity We rate the vulnerability as high severity as (1) the buffer overflow can be triggered when a scan is run with `CL_SCAN_ARCHIVE` enabled, which is enabled by default in most configurations. This feature is typically used to scan incoming emails on the backend of mail servers. As such, (2) a remote, external, unauthenticated attacker can trigger this vulnerability. The buffer overflow is powerful as an attacker can: Control the size of the target buffer between 512 bytes and 32768 bytes, must be a power of 2 Control the size of the overflow, must be a power of 2 Fully control the data of the overflow The overflow can be triggered multiple times in a loop Furthermore, ClamAV supports recursive parsing of various file-formats. As a result, an attacker has reasonable control over the heap. Data structures with function pointers are present in the code and could be used to gain IP control. ### Proof of Concept The following ZIP file contains a GPT file-system that has a HFS+ partition that triggers the buffer overflow and should cause a crash: [hfsplus.zip](https://drive.google.com/file/d/11Fa6XRktzqg0r_d_Ni4pglzIYj38ozEj/view?usp=share_link&resourcekey=0-ah1RRKZ1TqUkyMJa2xxcXg) The bug can be triggered by installing ClamAV on a fresh VM and then using the clamscan command to scan the PoC file: ``` sudo apt install -y clamav clamscan –debug hfsplus.zip LibClamAV debug: Recognized ZIP file # … LibClamAV debug: in cli_magic_scan_desc_type (recursion_level: 0/17) LibClamAV debug: Recognized Disk Image - GUID Partition Table file LibClamAV debug: cache_check: 6ea6a4bf1c43d68f524dfbe794976395 is negative LibClamAV debug: cli_scangpt: detected 512 sector size LibClamAV Warning: cli_scangpt: detected a non-protective MBR LibClamAV debug: cli_scangpt: Using primary GPT header # … LibClamAV debug: cli_magic_scan_nested_fmap_type: [1536, +180736) LibClamAV debug: magic_scan_nested_fmap_type: [0, +182784), [1536, +180736) LibClamAV debug: Recognized HFS+ partition partition LibClamAV debug: cache_check: 579222d51f405d9822196682aed4a166 is negative LibClamAV debug: cli_scanhfsplus: scanning partition content LibClamAV debug: hfsplus_volumeheader: HFS+ signature matched LibClamAV debug: HFS+ Header: LibClamAV debug: Signature: 482b LibClamAV debug: Attributes: 0 LibClamAV debug: File Count: 1 LibClamAV debug: Folder Count: 2 LibClamAV debug: Block Size: 16384 LibClamAV debug: Total Blocks: 1337 # … LibClamAV debug: cli_scanhfsplus: validation successful LibClamAV debug: hfsplus_fetch_node: need catalog block 0 LibClamAV debug: hfsplus_fetch_node: found block in extent 0 LibClamAV debug: leaf node Desc: fLink 0 bLink 0 kind 0 height 0 numRecords 0 LibClamAV debug: hfsplus_walk_catalog: invalid leaf node! double free or corruption (!prev) Aborted (core dumped) ``` ### Further Analysis #### Root-Cause Analysis The entry-point for HFS+ scanning in ClamAV is ````cli_scanhfsplus()``` in [libclamav/hfsplus.c](https://github.com/Cisco-Talos/clamav/blob/cf812993b68ba42ff2253da757053cc09fc434cb/libclamav/hfsplus.c#L1423). This function receives a pointer to the current context, this context among other data structures also contains a pointer to the fully user-controlled buffer that was recognized as a HFS+ partition. HFS+ partitions are divided into blocks, usually 512 bytes large. However, this size may vary and is indicated in the [volume header](https://developer.apple.com/library/archive/technotes/tn/tn1150.html#VolumeHeader). ClamAV parses this header to determine the block size and location of the blocks of the catalog header. The catalog is a B-Tree that contains all files and directories in a HFS+ partition and as

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-r6g3-3wqj-m3c8
• github.com/google/security-research