CVE-2020-3350: 
Clam AntiVirus vulnerability analysis and mitigation

A vulnerability (CVE-2020-3350) was discovered in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus that was disclosed in June 2020. The vulnerability affects multiple versions of ClamAV up to (excluding) version 0.102.4 and Cisco AMP for Endpoints up to (excluding) version 1.12.4 on Linux and macOS platforms (NVD).

The vulnerability is due to a race condition that could occur when scanning malicious files. It has been assigned a CVSS v3.1 base score of 6.3 (Medium) by NIST with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, while Cisco assessed it with a score of 5.5 (Medium) (NVD).

A successful exploit could allow an attacker to delete arbitrary files on the system that they would not normally have privileges to delete. This could result in system instability or cause the endpoint software to stop working (CVE).

The vulnerability requires an authenticated, local attacker with shell access to exploit. The attacker could trigger the vulnerability by executing a script that could trigger the race condition (NVD).

The vulnerability was fixed in ClamAV version 0.102.4. Multiple Linux distributions released security updates to address this issue, including Ubuntu (versions 20.04, 18.04, 16.04, 14.04, and 12.04), Debian 9, and Fedora (versions 31 and 32) (Ubuntu, Debian).