Heap-buffer-overflow in H5MM_memcpy in matio
Summary
OSV-2023-723: Heap-buffer-overflow in H5MM_memcpy. Affects matio versions >= f94c087aa9be54ec86a01e267b80fd61108069be, < cf58a80672f4a36490cfe81de80805496218d49b. Fixed in cf58a80672f4a36490cfe81de80805496218d49b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matio is an open-source library that provides support for reading and writing MATLAB MAT files. It is commonly used in scientific and engineering applications to exchange data between MATLAB and other programming languages. The library allows users to manipulate and access the data stored in MAT files, which can contain variables, arrays, and structures. However, a vulnerability has been discovered in the library that could lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability, identified as OSV-2023-723, originates from a heap-buffer-overflow in the H5MM_memcpy function within matio. This vulnerability allows an attacker to write beyond the bounds of a heap buffer, potentially leading to a crash or arbitrary code execution. The issue was reported through the OSS-Fuzz project and has been assigned a severity rating of HIGH. The vulnerable code path involves H5D__scatter_mem and H5D__scatgath_read functions.
How To Fix
Minimum fixed version
cf58a80672f4a36490cfe81de80805496218d49b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider avoiding the usage of the affected functions or disabling the functionality that relies on them. However, it is strongly advised to apply the official fix as soon as possible to ensure the security and stability of the application.
Conclusion
In conclusion, the matio library is vulnerable to a heap-buffer-overflow in the H5MM_memcpy function. This vulnerability can be exploited to crash the application or potentially execute arbitrary code. Users are advised to update their matio installation to a version that includes the fix or apply the temporary workaround until the fix can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matio →
FAQ
Matio is an open-source library for reading and writing MATLAB MAT files.
A heap-buffer-overflow is a type of vulnerability where a program writes beyond the bounds of a heap-allocated buffer.
This vulnerability can be exploited by an attacker to crash the application or potentially execute arbitrary code.
Yes, the vulnerability has been fixed in a later version of the matio package. Users should update to a version that includes the fix.
This vulnerability has been assigned a severity rating of HIGH.
References
Related vulnerabilities
Recent vulnerabilities recorded for matio.
