Denial of Service Vulnerability in ClamAV's HFS+ Filesystem Image Parser

CVE-2023-20197

What is CVE-2023-20197?

A flaw in the filesystem image parser for Hierarchical File System Plus (HFS+) in ClamAV allows an unauthenticated, remote attacker to potentially trigger a denial of service (DoS) condition. This vulnerability arises from an improper check for completion when decompressing a file, which can lead to an infinite loop scenario, making the affected software unresponsive. By submitting a specially crafted HFS+ filesystem image for scanning, an attacker can exploit this flaw, resulting in the ClamAV scanning process halting and consuming system resources, ultimately disrupting service availability. Further details can be found in the ClamAV blog and security advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References