HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.
The CWE-122 class error (heap-based buffer overflow) involves overwriting data beyond the boundaries of an allocated buffer on the heap during a read operation in the H5HG_read function. The overflow causes corruption of the instruction pointer, which opens the possibility of taking control over the program's execution flow. An attacker can trigger this error by providing a specially crafted HDF5 file for processing by the vulnerable library.
An attacker can cause denial of service (DoS) or — in case of successful instruction pointer manipulation — arbitrary code execution (RCE) in the context of the process handling a malicious HDF5 file.
The HDF5 library should be updated to version 1.14.4 or newer, where the vulnerability has been fixed according to vendor information available at: https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
HDF5 (Hdfgroup) in versions up to and including 1.14.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHdfgroup Hdf5
APPHdfgroup≤ 1.14.3
Related vulnerabilities
Podatność RCE/DoS w bibliotece HDF5 — uszkodzenie pamięci w H5A__close
HDF5 Library: użycie niezainicjowanej wartości w H5A__attr_release_table
Buffer overflow w HDF5 H5Z__filter_scaleoffset – RCE lub DoS
Stack buffer overflow w HDF5 — RCE lub DoS przez uszkodzenie wskaźnika instrukcji
HDF5 Library: heap-based buffer overflow w dekompresji nbit