Out-of-Bounds Read Vulnerability in HDF5 Package: Potential Code Execution Risk
Summary
DEBIAN-CVE-2022-25942: An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. Affects hdf5 versions < 1.10.10+repack-1. Fixed in 1.10.10+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HDF5 is a widely used data model, library, and file format for storing and managing data. It is designed to store large amounts of data and is utilized in various scientific and engineering applications. The HDF5 Group's libhdf5 version 1.10.4 has been identified to have a critical vulnerability in its gif2h5 functionality, which can be exploited through specially crafted GIF files.
Vulnerability Detail
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group's libhdf5 version 1.10.4. This vulnerability allows an attacker to craft a malicious GIF file that, when processed, can lead to code execution on the affected system. The vulnerability arises from improper handling of input data, which can result in reading beyond allocated memory boundaries, potentially allowing an attacker to execute arbitrary code.
How To Fix
Minimum fixed version
1.10.10+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid processing untrusted or unknown GIF files with the HDF5 library until the package is updated to the fixed version.
Conclusion
The out-of-bounds read vulnerability in the HDF5 package poses a significant risk of code execution through malicious GIF files. It is crucial for users to update their HDF5 installations to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for hdf5 →
FAQ
The vulnerability is an out-of-bounds read issue that can lead to code execution when processing malicious GIF files.
HDF5 versions prior to 1.10.10+repack-1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, avoid using the HDF5 library to process any untrusted GIF files as a temporary measure.
More details can be found in the CVE report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-25942.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
