CVE-2024-20506

What it actually does

The vulnerability allows the privileged ClamD process to write log data to a file replaced by a symbolic link pointing to a critical system file, enabling corruption of the target via appended log messages after a process restart.

Why it matters to the business

Attackers with local access can cause system instability, data corruption, or service outages on systems using ClamAV for scanning, potentially requiring recovery efforts and disrupting email, file, or endpoint protection workflows.

How an attack unfolds

A local authenticated attacker replaces the ClamD log file with a symlink to a critical system file, restarts the ClamD service, and triggers log writes that append data and corrupt the linked target file.

How to fix it

Upgrade to the fixed version available in commit 93d9e734200ad2eec6d1af6d52e0a4b7a7ae5d26 or later releases that validate log file targets before writing.

How to confirm the fix worked

Confirm ClamAV is updated past vulnerable versions 1.4.0, 1.3.2, 1.2.x, 1.0.6, 0.105.x, 0.104.x, and 0.103.11; test that log writes fail or are rejected when the log path is a symlink.

Typical attack path

1. Obtain local authenticated access on the target system
2. Replace the ClamD log file with a symbolic link to a critical system file
3. Restart the ClamD process
4. Trigger log writes to append data and corrupt the target file

How to detect it

Review system and ClamD logs for unexpected service restarts, check for symlink replacements on log paths, and inspect critical system files for unexpected appended content matching ClamD log formats.

• clamd.log replaced by symlink
• clamd process appending to /etc/passwd or similar system paths
• unexpected clamd restarts followed by file corruption events

What your security team should do

• Apply the patch from commit 93d9e734200ad2eec6d1af6d52e0a4b7a7ae5d26 without delay
• Restrict local write access to ClamD log directories
• Harden service restart permissions for ClamD
• Implement file integrity monitoring on critical system paths