HDF5 Out-of-Bounds Read Vulnerability in Array Datatype Handling

A vulnerability in HDF5 versions 2.0.0 prior to 2.1.0 allows for out-of-bounds read operations triggered by corrupted array datatype metadata. The issue arises when the full size of the datatype, the number of elements, and the element size are inconsistent, leading to misaligned data interpretations. This vulnerability is only present in files that have been maliciously altered, as normal usage does not typically allow for such discrepancies.

Impact

Exploitation of this vulnerability causes out-of-bounds read errors, which can lead to memory corruption or disclosure of sensitive information.

Reproduction

The vulnerability can be reproduced by creating an HDF5 file with a corrupted array datatype that misaligns the full size, element count, and element size. This can be done using the H5Dselect or H5Aint functions to manipulate the datatype attributes. The repository 'hdf5-crashes' contains examples of such corrupted files that trigger the out-of-bounds read when accessed with H5dump or H5repack.

Remediation

Users can upgrade to HDF5 version 2.1.0 or later to address this vulnerability.