Heap-Based Buffer Over-Read in HDF5 Library: CVE-2024-32620
Summary
DEBIAN-CVE-2024-32620: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F_addr_decode_len in H5Fint.c, resulting in the corruption of the instruction pointer. Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HDF5 library is a widely used open-source software library designed for managing and storing large amounts of data. It provides a versatile data model that can represent complex data relationships and is utilized in various fields such as scientific computing, engineering, and data analysis. However, versions of HDF5 up to 1.14.3 are vulnerable to a critical issue that can lead to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-32620 is a heap-based buffer over-read found in the H5F_addr_decode_len function within the H5Fint.c file of the HDF5 library. This flaw can result in the corruption of the instruction pointer, potentially allowing an attacker to execute arbitrary code or crash the application. The vulnerability arises from improper handling of memory, which can be exploited if an attacker can manipulate the input data processed by the library.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable functions of the HDF5 library until they can apply the patch. It is advisable to review the application code to ensure that it does not rely on the affected functionality.
Conclusion
The HDF5 library vulnerability CVE-2024-32620 poses significant risks due to a heap-based buffer over-read issue. Users are strongly advised to update to the patched version to mitigate potential security threats. Regular monitoring and updates are essential to maintain software security.
See every vulnerability recorded for hdf5 →
FAQ
CVE-2024-32620 is a vulnerability in the HDF5 library that allows for a heap-based buffer over-read, potentially leading to security risks.
Versions of the HDF5 library up to and including 1.14.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you cannot update the library right away, avoid using the vulnerable functions and review your application code for potential risks.
More information can be found in the official CVE database or through security advisories related to the HDF5 library.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
