HDF5 Heap-Based Buffer Overflow Vulnerability in H5O__mtime_new_encode Function

A heap-based buffer overflow vulnerability has been identified in HDF5 version 1.14.6. The issue arises in the H5O__mtime_new_encode function within the file src/H5Omtime.c. This vulnerability requires local exploitation and has been publicly disclosed.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

The vulnerability can be reproduced by compiling HDF5 with Clang, using AddressSanitizer to detect memory errors. After building the library, a fuzzing harness can be used to trigger the vulnerability by sending specially crafted input that exploits the buffer overflow in the H5O__mtime_new_encode function.

Remediation

Users are advised to update to HDF5 version 2.0.0 or later, where this vulnerability has been addressed.