CVE-2022-20698
📋 TL;DR
This vulnerability in ClamAV's OOXML parsing module allows remote attackers to crash the antivirus scanning process by sending specially crafted OOXML files. This causes a denial of service, potentially disrupting malware scanning capabilities. Affected users include anyone running vulnerable ClamAV versions for email filtering, file scanning, or web content inspection.
💻 Affected Systems
- Clam AntiVirus (ClamAV)
📦 What is this software?
Clamav by Clamav
Clamav by Clamav
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of antivirus scanning services, allowing malware to pass through undetected while the service is down.
Likely Case
Temporary denial of service affecting ClamAV scanning processes, requiring service restart and potentially causing scanning backlogs.
If Mitigated
Minimal impact with proper network filtering and updated software, though scanning of malicious OOXML files might still trigger crashes.
🎯 Exploit Status
Exploitation requires delivering a crafted OOXML file to trigger the invalid pointer read.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.104.2 or 0.103.5 LTS
Vendor Advisory: https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html
Restart Required: Yes
Instructions:
1. Stop ClamAV services. 2. Update ClamAV to version 0.104.2 or 0.103.5 LTS using your package manager. 3. Update virus definitions with 'freshclam'. 4. Restart ClamAV services.
🔧 Temporary Workarounds
Disable OOXML parsing
allTemporarily disable OOXML file scanning in ClamAV configuration
Edit clamd.conf and add: ScanOLE2 false
Restart clamd service
Network filtering
allBlock or quarantine OOXML files at network perimeter
🧯 If You Can't Patch
- Implement strict file upload filtering to block suspicious OOXML files
- Monitor ClamAV process health and implement automatic restart on crash
🔍 How to Verify
Check if Vulnerable:
Run 'clamscan --version' and check if version is 0.104.1 or earlier, or 0.103.4 LTS or earlierCheck Version:
clamscan --version | head -1Verify Fix Applied:
Confirm version is 0.104.2 or 0.103.5 LTS with 'clamscan --version'📡 Detection & Monitoring
Log Indicators:
- ClamAV process crashes
- Segmentation fault errors in system logs
- Scanning service stopped unexpectedly
Network Indicators:
- Unusual OOXML file transfers to scanning servers
- Multiple failed scan attempts
SIEM Query:
source="clamav" AND ("segmentation fault" OR "crash" OR "abnormal exit")