HDF5 Buffer Underflow Vulnerability in H5Iget_name Function

A buffer underflow vulnerability has been identified in the HDF5 library, specifically in versions through 1.14.6. The issue arises in the H5Iget_name function when it is called with a group ID and a size parameter of zero. This leads to an underflow as the function attempts to write a null terminator into the buffer. The vulnerability can be exploited if the size parameter is manipulated to zero, and there is sensitive data preceding the name buffer.

Impact

Exploitation of this vulnerability causes a buffer underflow, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by creating a group in an HDF5 file and then calling the H5Iget_name function with a size parameter of zero. This can be done using a simple C program that links against the HDF5 library. The program should be compiled with AddressSanitizer enabled, which will highlight the buffer underflow issue.

Remediation

Users can upgrade to HDF5 version 2.1.0 or later, where this vulnerability has been patched.