Heap Buffer Overflow in HDF5 N-Bit Filter

Executive Summary

This vulnerability is an out-of-bounds heap read in the HDF5 library's N-Bit filter decompression functions. The functions H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic advance a read index into the compressed chunk buffer without checking against the buffer's actual size. This allows attackers to cause a heap read beyond the buffer's limits using a crafted HDF5 file with N-Bit filter parameters describing more decompressed data than the stored compressed chunk contains.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes when processing HDF5 files with the h5ls or h5repack tools. Use commands like h5ls -d on suspicious files to check for SIGSEGV errors during N-Bit filter decompression.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause crashes (SIGSEGVs) when processing malformed HDF5 files using tools like h5ls or h5repack. It may lead to disclosure of adjacent heap memory into decompressed dataset values in constrained cases. Attackers can exploit this by providing specially crafted files to trigger unexpected termination of applications using the HDF5 library.

Useful 0 Not Useful 0

Mitigation Strategies

Update HDF5 to a patched version that includes bounds checking in N-Bit decompression functions. Avoid processing untrusted HDF5 files with h5ls or h5repack until the update is applied.

Useful 0 Not Useful 0