Forest Global Training Partners

Cyber Risks · Cisco Talos

Introduction to ClamAV's Low Level Virtual Machine (LLVM)

Summary: ClamAV 0.96 added a bytecode interpreter and a JIT Low Level Virtual Machine (LLVM), which greatly increased the size of the tarball and extended detection capabilities by allowing it to interpret and execute bytecode. The article walks through writing custom bytecode, including configuring ClamAV with --enable-unsigned-bytecode to load unsigned bytecode, building the bytecode compiler, and a case study detecting CVE-2008-2238, an integer overflow in OpenOffice's parsing of Enhanced Metafiles triggered when the Chars value is 0x80000000 bytes or greater.

What's compelling: Custom bytecode is written in C, so authors can introduce buffer overflows and infinite loops; ClamAV mitigates this with bounds-checked memory accesses, execution timeouts, and stack smashing protection, but the article states these protections are not guaranteed to be perfect.

Read the original at Cisco Talos ↗

Topics
Malware
Mentions
CVE-2008-2238
Related