HDF5 Divide-by-Zero in H5O__layout_decode via Mismatched Chunk-Dataspace Ranks

Executive Summary

This vulnerability exists in HDF5 through version 2.3.0. It occurs when a chunked dataset's stored chunk-layout dimensionality does not match its dataspace rank during dataset opening. The check for this mismatch is only performed at dataset creation time, not when opening an existing dataset. This allows attackers to exploit the issue by providing a crafted HDF5 file with mismatched chunk and dataspace ranks. When such a file is opened and read using functions like H5Dopen2 and H5Dread, it triggers a divide-by-zero error in H5S__hyper_iter_get_seq_list, causing the application to crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for crashes or errors when opening or reading HDF5 files with mismatched chunk/dataspace ranks using tools like h5repack. Monitor for divide-by-zero errors in H5S__hyper_iter_get_seq_list during file operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service conditions. If you open and read a maliciously crafted HDF5 file using tools like h5repack, the application may crash due to a divide-by-zero error. This could disrupt services relying on HDF5 for data storage and processing, potentially causing data unavailability or loss of functionality.

Useful 0 Not Useful 0

Mitigation Strategies

Update HDF5 to a version beyond 2.3.0 where the validation is properly enforced. Avoid opening untrusted HDF5 files with tools like h5repack until patched. Implement file integrity checks before processing HDF5 datasets.

Useful 0 Not Useful 0