HDFGroup HDF5 Heap-Use-After-Free Vulnerability in Version 1.14.6

A heap-use-after-free vulnerability has been identified in HDF5 version 1.14.6. The issue arises in the function H5FL__reg_gc_list within the file src/H5FL.c. This vulnerability can be exploited locally, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a heap-use-after-free condition, which can lead to memory corruption. In this case, it has been demonstrated to cause a denial-of-service by crashing the application.

Reproduction

The vulnerability can be reproduced by compiling HDF5 with Clang, using specific compiler flags to enable address sanitization and optimization settings that facilitate fuzzing. After building the library, a fuzzing harness can be used to trigger the vulnerability by sending crafted input that exploits the use-after-free condition.