Heap-Based Buffer Over-Read in HDF5 Library - CVE-2024-32613
Summary
DEBIAN-CVE-2024-32613: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL__fl_deserialize in H5HLcache.c, a different vulnerability than CVE-2024-32612. Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HDF5 library is a widely used open-source software library and file format designed for storing and managing large amounts of data. It is particularly popular in scientific computing, data analysis, and engineering applications due to its ability to handle complex data structures and support for various data types. However, versions of HDF5 up to 1.14.3 are vulnerable to a heap-based buffer over-read, which can lead to potential data leaks and security breaches.
Vulnerability Detail
The vulnerability identified as CVE-2024-32613 is a heap-based buffer over-read that occurs in the function H5HL__fl_deserialize within the H5HLcache.c file of the HDF5 library. This flaw allows an attacker to read beyond the intended memory boundaries, potentially exposing sensitive data. The issue arises from improper handling of memory during deserialization processes, which can lead to unauthorized access to data stored in memory. This vulnerability is distinct from CVE-2024-32612, indicating a separate security concern that needs to be addressed.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable functions in the HDF5 library until the package is updated. It is advisable to review the code for any calls to H5HL__fl_deserialize and replace or remove them if possible.
Conclusion
CVE-2024-32613 represents a significant security vulnerability in the HDF5 library, necessitating prompt action from users to update their software to the patched version. By following the recommended steps to fix the issue and utilizing tools like Vulert, users can enhance their security posture and mitigate risks associated with this vulnerability.
See every vulnerability recorded for hdf5 →
FAQ
CVE-2024-32613 is a vulnerability in the HDF5 library that allows for a heap-based buffer over-read, potentially exposing sensitive data.
Versions of HDF5 up to 1.14.3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The consequences include potential data leaks and unauthorized access to sensitive information stored in memory.
You can update the HDF5 package by running the commands: sudo apt-get update followed by sudo apt-get install hdf5 in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
