Simon Scannell Remotely Exploiting An Antivirus Engine

ClamAV Attack Surface

Google Cloud researcher Simon Scannell targets ClamAV, the widely deployed open-source AV scanning emails, web uploads, Zimbra, Cisco secure web appliances, and cloud storage pipelines. Written in C, it recursively unpacks archives and dispatches format-specific parsers—many complex (HFS+, DMG, cpio)—expanding untrusted input reach.

Non-Interactive Exploitation Constraints

ClamAV is not a conversational protocol; attackers typically learn only scan pass/fail via intermediaries. Full ASLR, multithreaded clamd restarts on segfault after signature reload delays, blocking classic info-leak-then-ROP chains, partial overwrites, data-only heap corruption, or brute-force ASLR.

CVE-2023-20032 HFS+ Overflow

A missing bounds check lets attacker-controlled HFS+ volume read_size trigger a powerful heap overflow (4KB–2MB) during Apple filesystem parsing—remotely triggerable in default configs (CVSS 9.8). Nesting malicious inner formats inside allowed containers bypasses upload filters.

Exploitation Strategy and Case Study

Despite constraints, Scannell details novel approaches to achieve impact without pointer leaks, culminating in an authenticated remote code execution case study on an email server—turning the defender into the attacked component.