Out-of-Bounds Read in HDF5 Library via SZIP Decoding

Executive Summary

This vulnerability is an out-of-bounds read in the HDF5 library affecting versions through 2.2.0. It occurs in the szip decompression function H5Z__filter_szip() when processing a corrupted or truncated chunk. The function subtracts a 4-byte uncompressed-length header from the chunk length without checking if the chunk is at least 4 bytes long. If the chunk is shorter, the calculation wraps around to a very large value, causing the decompressor to read far beyond the intended buffer. This can lead to denial of service if exploited by an attacker who tricks a user into reading a crafted HDF5 file.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your system uses HDF5 with szip support and if it processes crafted HDF5 files. Monitor for crashes or memory corruption when reading HDF5 files. No specific commands are provided in the context to detect this issue directly.

Useful 0 Not Useful 0

Impact Analysis

If you use HDF5 with szip support (libaec or szip library), an attacker could exploit this to cause a denial of service by crashing your application or system when you read a specially crafted HDF5 file. This requires the attacker to provide the malicious file and trick you into opening it.

Useful 0 Not Useful 0

Mitigation Strategies

Update HDF5 to a patched version that includes the fix from the referenced pull request. Disable szip support if not required. Avoid processing untrusted HDF5 files until the update is applied.

Useful 0 Not Useful 0