Heap-Based Buffer Overflow in HDF5 Package: CVE-2021-45830
Summary
DEBIAN-CVE-2021-45830: A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which could cause a Denial of Service. Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HDF5 is a widely used file format and set of tools for managing complex data. It is designed to store and organize large amounts of data, providing high performance and flexibility. HDF5 is utilized in various domains, including scientific computing, engineering, and data analysis. However, a vulnerability has been identified in versions prior to 1.14.5+repack-1, which could lead to severe security risks.
Vulnerability Detail
A heap-based buffer overflow vulnerability exists in HDF5 version 1.13.1-1, specifically in the function H5F_addr_decode_len located in /hdf5/src/H5Fint.c. This flaw can potentially allow an attacker to exploit the overflow, leading to a Denial of Service (DoS) condition. The vulnerability arises from improper handling of memory allocation, which can be manipulated to overwrite adjacent memory, causing unexpected behavior or crashes.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than updating to the patched version. It is advisable to monitor the application for any unusual behavior until the update can be applied.
Conclusion
The HDF5 package has a critical vulnerability (CVE-2021-45830) that can lead to a heap-based buffer overflow, resulting in Denial of Service. It is essential to update to the patched version 1.14.5+repack-1 to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for hdf5 →
FAQ
CVE-2021-45830 is a vulnerability in the HDF5 package that allows for a heap-based buffer overflow, potentially leading to Denial of Service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is Denial of Service, which can disrupt the normal functioning of applications relying on the HDF5 package.
Yes, the patched version is 1.14.5+repack-1. Updating to this version will resolve the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
