HDF5 vulnerabilities

In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.

The HDF5 1.8.16 library has a vulnerability that allows modification of the loop's index when initializing an array, potentially leading to out-of-bounds access. The value used for space allocation comes from the file, creating a risk of manipulation by an attacker.

The HDF5 library version 1.8.16 fails to check if certain message types support a particular flag, leading to casting the structure to an alternative structure and assigning values to fields not supported by the message type. This can result in code execution under the context of the library.

When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library fails to ensure that the precision is within the bounds of the size, leading to arbitrary code execution.

The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.

A vulnerability in HDF5 through 2.3.0 in the H5Z__filter_fletcher32 function in H5Zfletcher32.c. The function computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g., by the h5ls or h5dump tools.

A vulnerability in HDF5 through 2.3.0 in the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c. These functions advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g., by the h5ls or h5repack tools.

H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0. Attackers can cause denial of service via a dataset with 'defined' flag and negative size field.

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file with an oversized chunk size field via h5repack may cause the application to abort due to a double free.

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 allows attackers to cause a denial of service (crash) via a crafted HDF5 file with a shared-message list index declaring a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes.

Vulnerability in the HDF5 library: invoking `H5Iget_name` on a group id with a size parameter of 0 causes an underflow when trying to place a null terminator in the buffer. This may lead to unexpected behavior if important data precedes the buffer.

The HDF5 library is vulnerable to an out-of-bounds read when a file is maliciously crafted – the array datatype size, element count, and element size are inconsistent. The vulnerability only occurs in deliberately altered files, not in normal usage.

In HDF5 library version 1.14.1-2 and earlier, a heap-use-after-free vulnerability was found in the h5dump helper utility. An attacker can supply a malicious h5 file, causing a reference to a freed object in a memmove call from H5T__conv_struct.

In HDF5 prior to version 1.14.4-2, a write-based heap buffer overflow vulnerability exists that can be triggered by a crafted `h5` file. An attacker can cause a denial-of-service (DoS) and potentially remote code execution (RCE) depending on exploitability.