Critical Stack Buffer Overflow in HDF5 Package Leading to Potential Code Execution
Summary
DEBIAN-CVE-2024-29158: HDF5 through 1.14.3 contains a stack buffer overflow in H5FL_arr_malloc, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HDF5 is a widely used file format and set of tools for managing complex data. It is designed to store and organize large amounts of data efficiently. The HDF5 library is utilized in various scientific and engineering applications, providing capabilities for data storage, retrieval, and sharing. However, versions up to 1.14.3 are vulnerable to a stack buffer overflow, which can compromise the integrity of applications relying on this library.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-29158 is a stack buffer overflow present in the H5FL_arr_malloc function of HDF5 versions up to 1.14.3. This flaw can lead to corruption of the instruction pointer, resulting in denial of service or potential code execution. Attackers may exploit this vulnerability to execute arbitrary code, posing significant risks to system security and stability.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functions in HDF5 until they can update to the patched version. Additionally, implementing strict input validation may help mitigate the risk of exploitation.
Conclusion
The HDF5 package is critical for managing complex data, but it is vulnerable to a serious stack buffer overflow issue in versions up to 1.14.3. Users are strongly advised to update to version 1.14.5+repack-1 to mitigate risks associated with this vulnerability. For ongoing monitoring of open-source vulnerabilities, consider using Vulert, which can alert you in real-time without requiring code access.
See every vulnerability recorded for hdf5 →
FAQ
The vulnerability is a stack buffer overflow that can lead to instruction pointer corruption, potentially allowing for denial of service or code execution.
HDF5 versions up to and including 1.14.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, avoid using the affected functions and implement strict input validation as a temporary workaround.
Failure to address this vulnerability may lead to system instability, unauthorized code execution, and potential data breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
