On Jun 20, 2022, at 3:28 PM, Viktor Rosenfeld via clamav-users <clamav-users@lists.clamav.net> wrote:
Hi,

A recent scan of my system found 8 infected files. On closer inspection, these are all nodejs binaries, either installed through Homebrew or inside another app (e.g., Docker or Adobe). Clamav reports that they are infected with CVE_2021_4034-9951522.

As far as I can tell, CVE_2021_4034 is the pkexec privilege escalation bug. However, I could not find anything relating to nodejs. Also, the fact that multiple nodejs binaries on my system are infected, which are installed from different sources, leads me to believe that this is a false positive.

I am unsure what to do next. Should I upload this as a false positive to https://www.clamav.net/reports/fp?

Best,
Viktor

Powered by Mailbutler - still your inbox, but smarter.
Strangely, I was unable to determine when that signature was added to the ClamAV database as it's not listed on any of the update notices I receive on the [clamav-virusdb] list. Although it's a 2021 CVE, it wasn't reported by Red Hat until the end of January, so most certainly had to be added by ClamAV this year after that.

But here is the complex signature that is used for matching:

VIRUS NAME: Osx.Exploit.CVE_2021_4034-9951522-1
TDB: Engine:91-255,Target:9
LOGICAL EXPRESSION: (0&1&2&3&4)>1|(5|6|7|8)>3|(9|10|11)>1
 * SUBSIG ID 0
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
/usr/bin/pkexec
 * SUBSIG ID 1
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
CMDTOEXECUTE=
 * SUBSIG ID 2
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
NOTTY=
 * SUBSIG ID 3
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
NOTTY_PORT=
 * SUBSIG ID 4
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
GCONV_PATH=
 * SUBSIG ID 5
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
Unable to execute pkexec
 * SUBSIG ID 6
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
Unable to write  payload
 * SUBSIG ID 7
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
Unable to make tmp dir
 * SUBSIG ID 8
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
Unable to write gconv module
 * SUBSIG ID 9
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
/Users/woody/Downloads/vul/poc-cve-2021-4034-main/exploit.go
 * SUBSIG ID 10
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
/Users/woody/Downloads/vul/poc-cve-2021-4034-main/payload/payload.go
 * SUBSIG ID 11
 +-> OFFSET: ANY
 +-> SIGMOD: NONE
 +-> DECODED SUBSIGNATURE:
payload.so

In checking with <https://nvd.nist.gov/vuln/detail/CVE-2021-4034> there's a header note, apparently placed there on June 14, that says:
This vulnerability has been modified and is currently undergoing reanalysis. Please check back soon to view the updated vulnerability summary.