Advisoriesby IbisCISCO: ClamAV Heap Buffer Overflow
Summary
A heap buffer overflow can be triggered in [ClamAV](https://github.com/Cisco-Talos/clamav)’s [HFSPlus](https://en.wikipedia.org/wiki/HFS_Plus) file-system parsing. The root-issue is a missing size check when copying blocks to a node buffer.
Severity
We rate the vulnerability as high severity as (1) the buffer overflow can be triggered when a scan is run with CL_SCAN_ARCHIVE enabled, which is enabled by default in most configurations. This feature is typically used to scan incoming emails on the backend of mail servers. As such, (2) a remote, external, unauthenticated attacker can trigger this vulnerability.
The buffer overflow is powerful as an attacker can:
Control the size of the target buffer between 512 bytes and 32768 bytes, must be a power of 2
Control the size of the overflow, must be a power of 2
Fully control the data of the overflow
The overflow can be triggered multiple times in a loop
Furthermore, ClamAV supports recursive parsing of various file-formats. As a result, an attacker has reasonable control over the heap. Data structures with function pointers are present in the code and could be used to gain IP control.
Proof of Concept
The following ZIP file contains a GPT file-system that has a HFS+ partition that triggers the buffer overflow and should cause a crash:...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ClamAV Product | all versions | No fix yet |
Details and references
### Summary A heap buffer overflow can be triggered in [ClamAV](https://github.com/Cisco-Talos/clamav)’s [HFSPlus](https://en.wikipedia.org/wiki/HFS_Plus) file-system parsing. The root-issue is a missing size check when copying blocks to a node buffer. ### Severity We rate the vulnerability as high severity as (1) the buffer overflow can be triggered when a scan is run with `CL_SCAN_ARCHIVE` enabled, which is enabled by default in most configurations. This feature is typically used to scan incoming emails on the backend of mail servers. As such, (2) a remote, external, unauthenticated attacker can trigger this vulnerability. The buffer overflow is powerful as an attacker can: Control the size of the target buffer between 512 bytes and 32768 bytes, must be a power of 2 Control the size of the overflow, must be a power of 2 Fully control the data of the overflow The overflow can be triggered multiple times in a loop Furthermore, ClamAV supports recursive parsing of various file-formats. As a result, an attacker has reasonable control over the heap. Data structures with function pointers are present in the code and could be used to gain IP control. ### Proof of Concept The following ZIP file contains a GPT file-system that has a HFS+ partition that triggers the buffer overflow and should cause a crash: [hfsplus.zip](https://drive.google.com/file/d/11Fa6XRktzqg0r_d_Ni4pglzIYj38ozEj/view?usp=share_link&resourcekey=0-ah1RRKZ1TqUkyMJa2xxcXg) The bug can be triggered by installing ClamAV on a fresh VM and then using the clamscan command to scan the PoC file: ``` sudo apt install -y clamav clamscan –debug hfsplus.zip LibClamAV debug: Recognized ZIP file # … LibClamAV debug: in cli_magic_scan_desc_type (recursion_level: 0/17) LibClamAV debug: Recognized Disk Image - GUID Partition Table file LibClamAV debug: cache_check: 6ea6a4bf1c43d68f524dfbe794976395 is negative LibClamAV debug: cli_scangpt: detected 512 sector size LibClamAV Warning: cli_scangpt: detected a non-protective MBR LibClamAV debug: cli_scangpt: Using primary GPT header # … LibClamAV debug: cli_magic_scan_nested_fmap_type: [1536, +180736) LibClamAV debug: magic_scan_nested_fmap_type: [0, +182784), [1536, +180736) LibClamAV debug: Recognized HFS+ partition partition LibClamAV debug: cache_check: 579222d51f405d9822196682aed4a166 is negative LibClamAV debug: cli_scanhfsplus: scanning partition content LibClamAV debug: hfsplus_volumeheader: HFS+ signature matched LibClamAV debug: HFS+ Header: LibClamAV debug: Signature: 482b LibClamAV debug: Attributes: 0 LibClamAV debug: File Count: 1 LibClamAV debug: Folder Count: 2 LibClamAV debug: Block Size: 16384 LibClamAV debug: Total Blocks: 1337 # … LibClamAV debug: cli_scanhfsplus: validation successful LibClamAV debug: hfsplus_fetch_node: need catalog block 0 LibClamAV debug: hfsplus_fetch_node: found block in extent 0 LibClamAV debug: leaf node Desc: fLink 0 bLink 0 kind 0 height 0 numRecords 0 LibClamAV debug: hfsplus_walk_catalog: invalid leaf node! double free or corruption (!prev) Aborted (core dumped) ``` ### Further Analysis #### Root-Cause Analysis The entry-point for HFS+ scanning in ClamAV is ````cli_scanhfsplus()``` in [libclamav/hfsplus.c](https://github.com/Cisco-Talos/clamav/blob/cf812993b68ba42ff2253da757053cc09fc434cb/libclamav/hfsplus.c#L1423). This function receives a pointer to the current context, this context among other data structures also contains a pointer to the fully user-controlled buffer that was recognized as a HFS+ partition. HFS+ partitions are divided into blocks, usually 512 bytes large. However, this size may vary and is indicated in the [volume header](https://developer.apple.com/library/archive/technotes/tn/tn1150.html#VolumeHeader). ClamAV parses this header to determine the block size and location of the blocks of the catalog header. The catalog is a B-Tree that contains all files and directories in a HFS+ partition and as
- Severity from
- GitHub (reviewed advisory)