HDF5 Heap-Based Buffer Overflow Vulnerability in Cache Reconstruction Function

A critical heap-based buffer overflow vulnerability has been identified in HDF5 versions through 1.14.6. The issue arises in the function H5C__reconstruct_cache_entry within H5Cimage.c, where improper handling of cache entry structures leads to out-of-bounds memory access. This vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling HDF5 with AddressSanitizer enabled, using Clang as the compiler. After compiling the library, a proof-of-concept fuzzer can be used to trigger the vulnerability by opening a crafted dataset that exploits the buffer overflow during cache entry reconstruction.