Out-of-Bounds Read Vulnerability in HDF5 Package
Summary
DEBIAN-CVE-2024-32622: HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL_arr_malloc in H5FL.c (called from H5S_set_extent_simple in H5S.c). Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HDF5 is a widely used file format and library designed for storing and managing large amounts of data. It is particularly popular in scientific computing, data analysis, and high-performance computing applications. The library allows users to create, access, and share scientific data in a flexible and efficient manner. However, certain versions of HDF5 are vulnerable to an out-of-bounds read operation, which can lead to potential data leaks or application crashes.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-32622 affects HDF5 Library versions up to 1.14.3. It is caused by an out-of-bounds read operation in the function H5FL_arr_malloc located in H5FL.c, which is called from H5S_set_extent_simple in H5S.c. This flaw can lead to unauthorized access to memory locations, potentially exposing sensitive data or causing unexpected behavior in applications that rely on the HDF5 library.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functions in the HDF5 library until they can update to the patched version. However, this may limit the functionality of applications that depend on HDF5.
Conclusion
The out-of-bounds read vulnerability in the HDF5 package poses significant risks to applications that utilize this library. Users are strongly advised to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for hdf5 →
FAQ
The vulnerability is an out-of-bounds read operation that can lead to unauthorized memory access.
HDF5 versions up to 1.14.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to data leaks or application crashes, impacting the integrity and availability of data.
Yes, updating to HDF5 version 1.14.5+repack-1 or later will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
