HDF5 Heap-Based Buffer Overflow Vulnerability in Scale-Offset Filter Decompression Function

A critical heap-based buffer overflow vulnerability has been identified in HDF5 version 1.14.6. This issue arises in the Scale-Offset Filter's decompression function, H5Z__scaleoffset_decompress_one_byte, where the library improperly handles data, leading to a heap memory overflow. The vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling HDF5 with AddressSanitizer enabled, using Clang as the compiler. After building the library, the 'h5dump' tool can be used to read a crafted HDF5 file that triggers the buffer overflow. The AddressSanitizer will report the heap-buffer-overflow error, indicating that the vulnerability has been successfully exploited.