Heap Buffer Overflow in ClamAV Affects Local Users

CVE-2022-20792

What is CVE-2022-20792?

A vulnerability exists in the regex module used by the Clam AntiVirus signature database load module, allowing an authenticated local attacker to potentially crash the service and execute arbitrary code. This arises from improper bounds checking leading to a multi-byte heap buffer overflow. By placing a maliciously crafted CDB signature database file in the ClamAV database directory, an attacker can exploit the flaw, potentially gaining the ability to run code as the clamav user, threatening system integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References