Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Win.Downloader.LNKAgent-10001628-0 causing clamd to crash #923

Closed
LinuxMagicSupportTeam opened this issue May 16, 2023 · 15 comments · Fixed by #934
Closed

Win.Downloader.LNKAgent-10001628-0 causing clamd to crash #923

LinuxMagicSupportTeam opened this issue May 16, 2023 · 15 comments · Fixed by #934
Labels
🐛bug

Comments

@LinuxMagicSupportTeam
Copy link

Describe the bug

The new siganture Win.Downloader.LNKAgent-10001628-0 is causing clamd to crash even a database test being passed by freshclam.

It's been broght up on other online forums as well.

How to reproduce the problem

Logs:
freshclam[720]: Tue May 16 01:00:20 2023 -> Received signal: wake up
freshclam[720]: Tue May 16 01:00:20 2023 -> ClamAV update process started at Tue May 16 01:00:20 2023
freshclam[720]: Tue May 16 01:00:20 2023 -> daily database available for update (local version: 26907, remote version: 26908)
freshclam[720]: Tue May 16 01:00:21 2023 -> Testing database: '/var/lib/clamav/tmp.05d7654ad9/clamav-815c289ec8e7bb456a352c9aadb35fcb.tmp-daily.cld' ...
freshclam[1170615]: Tue May 16 01:00:24 2023 -> ~[LibClamAV] Don't know how to create filter for: Win.Downloader.LNKAgent-10001628-0
freshclam[1170615]: Tue May 16 01:00:24 2023 -> ~[LibClamAV] cli_ac_addpatt: cannot use filter for trie
freshclam[720]: Tue May 16 01:00:24 2023 -> Database test passed.
freshclam[720]: Tue May 16 01:00:24 2023 -> daily.cld updated (version: 26908, sigs: 2034816, f-level: 90, builder: raynman)
freshclam[720]: Tue May 16 01:00:25 2023 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
freshclam[720]: Tue May 16 01:00:25 2023 -> bytecode.cvd database is up-to-date (version: 334, sigs: 91, f-level: 90, builder: anvilleg)
freshclam[720]: Tue May 16 01:00:25 2023 -> Clamd successfully notified about the update.
clamd[768]: Tue May 16 01:00:25 2023 -> Reading databases from /var/lib/clamav
clamd[768]: LibClamAV Warning: Don't know how to create filter for: Win.Downloader.LNKAgent-10001628-0
clamd[768]: LibClamAV Warning: cli_ac_addpatt: cannot use filter for trie <---- clamd dies
@micahsnyder
Copy link
Contributor

Hi @LinuxMagicSupportTeam thanks for the report. We also received reports of this through the clamav-users mailing list. The signature has been dropped and an out-of-band build of a new daily.cvd with the signature removed was triggered.

We can keep this ticket open to track down the cause of the crash and fix the actual bug.

@mensfeld
Copy link

@micahsnyder thank you for your work. Any info on when the new daily.cvd should be alive?

@micahsnyder
Copy link
Contributor

I don't have a specific ETA. I've asked and will update if I find out before it goes live. I know it is being built right now and will be published immediately when it is ready.

@micahsnyder
Copy link
Contributor

It should be up in about 1 hour. I'll keep an eye out for it and say something when I see it.

@micahsnyder
Copy link
Contributor

Looks like it was a little faster than expected. daily-26909 is available now.

@jshernandez017
Copy link

Anyone else seeing this after updating to daily-26909?

clamscan -r --bell -i /path/to/package/scanned
LibClamAV Warning: PNG: Unexpected early end-of-file.
----------- SCAN SUMMARY -----------
Known viruses: 8666750
Engine version: 0.103.8
Scanned directories: 2381
Scanned files: 11702
Infected files: 0
Data scanned: 585.26 MB
Data read: 764.21 MB (ratio 0.77:1)
Time: 151.147 sec (2 m 31 s)
Start Date: 2023:05:16 23:26:28
End Date:   2023:05:16 23:29:00

@micahsnyder
Copy link
Contributor

The LibClamAV Warning: PNG: Unexpected early end-of-file. would be a warning from something strange observed when scanning a PNG found in one of the 11702 files are that you scanned. I imagine the same warning would occur with prior database versions as well.

@jshernandez017
Copy link

Thanks @micahsnyder, great work on resolving this quickly

@EmBitz
Copy link

EmBitz commented May 17, 2023 •
edited

Hi, I have the same problem, how do I install a daily version? only from source?
I'm on Debian 11

Thanks

@micahsnyder
Copy link
Contributor

micahsnyder commented May 18, 2023 •
edited

Hi @EmBitz just run freshclam to update to a newer version of the database.

@LinuxMagicSupportTeam
Copy link
Author

Hi, just checking to see if there is any update for the original issue with freshclaim and clamav's crashing on that Win.Downloader signature..?

Thanks!

@micahsnyder
Copy link
Contributor

@LinuxMagicSupportTeam Not yet. I'm hoping that I or a teammate will work on a fix next week. It seems like the bad signature is partially loaded causing a failing during a scan later. The cause of the crash is indexing a buffer[-1] which is basically trying to read 1 byte that is really far out of bounds.

Because the crash depends on a bad signature being loaded, and because it's a 1 byte out of bounds read, we're not going to consider it a security issue. We'll fix it sooner than later, but won't rush out a security patch release.

I do intend to backport the fix for 0.103, 1.0, and 1.1 though, just to try to prevent this kind of incident from happening again.

@LinuxMagicSupportTeam
Copy link
Author

Hello again, I am just following up on this ticket to see if there has been any update... Thanks!

micahsnyder added a commit to micahsnyder/clamav-micah that referenced this issue May 30, 2023
@micahsnyder
Abort signature load for short signature patterns
7b676a7 
If a signature has a pattern that is too short will fail to load the
siganture but does not cause the entire load process to abort.
This is bad for two reasons:
1) It is not immediately apparent that the signature is bad, and so it
could be published accidentally.
2) The signature is partially loaded by the time the bad pattern is
observed and that may cause a crash later.

Because of #1, it is not worth it to try to unload the first part of the
signature. Instead, we should just abort the signature load.

Fixes: Cisco-Talos#923
micahsnyder added a commit to micahsnyder/clamav-micah that referenced this issue May 30, 2023
@micahsnyder
Abort signature load for short signature patterns
41d8be2 
If a signature has a pattern that is too short will fail to load the
siganture but does not cause the entire load process to abort.
This is bad for two reasons:
1) It is not immediately apparent that the signature is bad, and so it
could be published accidentally.
2) The signature is partially loaded by the time the bad pattern is
observed and that may cause a crash later.

Because of (1), it is not worth it to try to unload the first part of the
signature. Instead, we should just abort the signature load.

Fixes: Cisco-Talos#923
@micahsnyder micahsnyder mentioned this issue May 30, 2023
Merged
micahsnyder added a commit that referenced this issue Jun 13, 2023
@micahsnyder
Abort signature load for short signature patterns
b778a6b 
If a signature has a pattern that is too short will fail to load the
signature but does not cause the entire load process to abort.
This is bad for two reasons:
1) It is not immediately apparent that the signature is bad, and so it
could be published accidentally.
2) The signature is partially loaded by the time the bad pattern is
observed and that may cause a crash later.

Because of (1), it is not worth it to try to unload the first part of the
signature. Instead, we should just abort the signature load.

Fixes: #923

We should also abort loading if the filter pattern for the boyer-moore
matcher is shorter than 2 bytes.

Also, do not print the final "Loading" progress bar if an error occurred.
micahsnyder added a commit to micahsnyder/clamav-micah that referenced this issue Jun 13, 2023
@micahsnyder
Abort signature load for short signature patterns
ca9a530 
If a signature has a pattern that is too short will fail to load the
signature but does not cause the entire load process to abort.
This is bad for two reasons:
1) It is not immediately apparent that the signature is bad, and so it
could be published accidentally.
2) The signature is partially loaded by the time the bad pattern is
observed and that may cause a crash later.

Because of (1), it is not worth it to try to unload the first part of the
signature. Instead, we should just abort the signature load.

Fixes: Cisco-Talos#923

We should also abort loading if the filter pattern for the boyer-moore
matcher is shorter than 2 bytes.

Also, do not print the final "Loading" progress bar if an error occurred.
@micahsnyder micahsnyder mentioned this issue Jun 13, 2023
Merged
micahsnyder added a commit that referenced this issue Jun 20, 2023
@micahsnyder
Abort signature load for short signature patterns
7e44e94 
If a signature has a pattern that is too short will fail to load the
signature but does not cause the entire load process to abort.
This is bad for two reasons:
1) It is not immediately apparent that the signature is bad, and so it
could be published accidentally.
2) The signature is partially loaded by the time the bad pattern is
observed and that may cause a crash later.

Because of (1), it is not worth it to try to unload the first part of the
signature. Instead, we should just abort the signature load.

Fixes: #923

We should also abort loading if the filter pattern for the boyer-moore
matcher is shorter than 2 bytes.

Also, do not print the final "Loading" progress bar if an error occurred.
@rma-x
Copy link

rma-x commented Aug 22, 2023

I do intend to backport the fix for 0.103, 1.0, and 1.1 though, [...]

It looks like the fix only made it into 1.0.2, but not 0.103.9? Do you still intend to backport it to 0.103?

@micahsnyder
Copy link
Contributor

@rma-x the signature was removed from the database so the crash is mitigated for all versions. We backported the fix for the 1.0.2 LTS version to make sure new signatures are tested with a version that will reject bad signatures to prevent the incident from happening again. So no plans to backport the fix to 0.103.x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
🐛bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

CLAM-2353 Abort signature load for short signature patterns micahsnyder/clamav-micah
6 participants
@mensfeld @rma-x @micahsnyder @jshernandez017 @EmBitz @LinuxMagicSupportTeam