Memory Corruption Vulnerability in HDF5 Package: UNKNOWN READ in H5FL_reg_malloc
Summary
OSV-2024-1044: UNKNOWN READ in H5FL_reg_malloc. Affects hdf5 across 4 version ranges.
>= 04f0647727677d716a3c1c772d35a660a8ea0dc5
>= 5a0ec52099cf02224a4066b158bcf1a34829db20, < ff3d6722a91587daaaac82e78b25d26ad3f50172
>= 966454aac1231da7209ef81c11055d3312181f99, < 7cc8b5e1010a09c892bc97ac32d9515c3777ce07
>= f527239564fc27a6e666ce734b88e4ab18765efc
Fixed in 7cc8b5e1010a09c892bc97ac32d9515c3777ce07. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HDF5 is a widely used open-source file format and set of tools for managing complex data. It is designed to store and organize large amounts of data efficiently. HDF5 supports various data types and is utilized in numerous scientific and engineering applications. However, it has been found to be vulnerable to a memory corruption issue that can lead to unexpected behavior or crashes.
Vulnerability Detail
The vulnerability identified as OSV-2024-1044 is a memory corruption issue that arises from an UNKNOWN READ in the H5FL_reg_malloc function. This vulnerability can be exploited through specific inputs that lead to crashes or potentially allow an attacker to manipulate memory. The issue originates from improper handling of memory allocation functions, which can result in a crash state during the deserialization process in the HDF5 library.
How To Fix
Minimum fixed version
7cc8b5e1010a09c892bc97ac32d9515c3777ce07
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functions that trigger the vulnerability until the package is updated. It is advisable to review the code and ensure that memory allocation functions are handled correctly to minimize the risk of crashes.
Conclusion
The HDF5 package has a significant memory corruption vulnerability that can lead to crashes and unexpected behavior. It is crucial for users to update to the patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for hdf5 →
FAQ
The vulnerability is a memory corruption issue that occurs during memory allocation in the HDF5 library.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
Exploitation of this vulnerability may lead to application crashes or unexpected behavior, potentially allowing an attacker to manipulate memory.
Yes, a patch is available. Users should update to version 7cc8b5e1010a09c892bc97ac32d9515c3777ce07 or later.
You can use tools like Vulert to monitor your applications for vulnerabilities in real-time without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
