Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2021-45830] Heap Buffer Overflow in H5F_addr_decode_len() #2228

Closed
e4t opened this issue Nov 7, 2022 · 1 comment
Closed

[CVE-2021-45830] Heap Buffer Overflow in H5F_addr_decode_len() #2228

e4t opened this issue Nov 7, 2022 · 1 comment
Assignees
@byrnHDF
Labels
Component - C Library Core C library issues (usually in the src directory) Priority - 1. High 🔼 These are important issues that should be resolved in the next release Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub

Comments

@e4t
Copy link
Contributor

e4t commented Nov 7, 2022

Description
CVE-2021-45830 provides a reproducer that causes a heap buffer overflow in H5F_addr_decode_len(). The issue is still seen in hdf5 version 1.13.3.
The cause of this is an incomplete bounds checking in the caller H5O__fsinfo_decode() as a buffer size verification is only done when decoding the file space address.
The heap overflow on read itself appears to be harmless from a security perspective. This may not be true for later memory accesses (possibly writes) based on inconsistent/invalid data read.
The overflow can be seen both with valgrind and the gcc address sanitizer (make CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" FCFLAGS="-g -fsanitize=address")

Expected behavior
Detect invalid hdf5 data properly and trigger the appropriate error handler.
Handle buffer overflow condition properly to avoid possible vulnerabilities thru manipulated hdf5 data files brought in circulation by bad actors.

Platform

  • HDF5 version 1.13.3
  • openSUSE Leap 15.4 / SLE 15.4 / openSUSE Tumbleweed
  • gcc 7 / gcc 11
  • autotools
  • configure --enable-fortran --enable-unsupported --enable-hl --enable-shared --enable-threadsafe --enable-build-mode=production --enable-cxx --with-pthread
@e4t e4t added the bug label Nov 7, 2022
@e4t e4t changed the title [BUG, CVE-2021-45830] [BUG, CVE-2021-45830] Heap Buffer Overflow in H5F_addr_decode_len() Nov 7, 2022
e4t added a commit to e4t/hdf5 that referenced this issue Nov 7, 2022
@e4t
H5O_fsinfo_decode() Make more resilient to out-of-bounds read
c34af72 
Malformed hdf5 files may have trunkated content which does not match
the expected size. This function attempts to decode these it will read
past the end of the allocated space which may lead to a crash. Make sure
each element is within bounds before reading.

This fixes CVE-2021-45830 / Bug HDFGroup#2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions
@e4t e4t mentioned this issue Nov 7, 2022
Merged
e4t added a commit to e4t/hdf5 that referenced this issue Nov 7, 2022
@e4t
H5O_fsinfo_decode() Make more resilient to out-of-bounds read
9a500cd 
Malformed hdf5 files may have trunkated content which does not match
the expected size. This function attempts to decode these it will read
past the end of the allocated space which may lead to a crash. Make sure
each element is within bounds before reading.

This fixes CVE-2021-45830 / Bug HDFGroup#2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions
e4t added a commit to e4t/hdf5 that referenced this issue Nov 9, 2022
@e4t
H4O_fsinfo_decode() Make more resilient to out-of-bounds read
854cb88 
Malformed hdf5 files may have trunkated content which does not match
the expected size. This function attempts to decode these it will read
past the end of the allocated space which may lead to a crash. Make sure
each element is within bounds before reading.

This fixes CVE-2021-45830 / Bug HDFGroup#2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions
e4t added a commit to e4t/hdf5 that referenced this issue Nov 10, 2022
@e4t
Make H5O__fsinfo_decode() more resilient to out-of-bound reads.
cc79fe4 
When decoding a file space info message in H5O__fsinfo_decode() make
sure each element to be decoded is still within the message. Malformed
hdf5 files may have trunkated content which does not match the
expected size. Checking this will prevent attempting to decode
unrelated data and heap overflows. So far, only free space manager
address data was checked before decoding.

This fixes CVE-2021-45830 / Bug HDFGroup#2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions
e4t added a commit to e4t/hdf5 that referenced this issue Nov 10, 2022
@e4t
Make H5O__fsinfo_decode() more resilient to out-of-bound reads.
633f1eb 
When decoding a file space info message in H5O__fsinfo_decode() make
sure each element to be decoded is still within the message. Malformed
hdf5 files may have trunkated content which does not match the
expected size. Checking this will prevent attempting to decode
unrelated data and heap overflows. So far, only free space manager
address data was checked before decoding.

This fixes CVE-2021-45830 / Bug HDFGroup#2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions
lrknox added a commit that referenced this issue Nov 11, 2022
@e4t @lrknox
Make H5O__fsinfo_decode() more resilient to out-of-bound reads. (#2229)
659bc99 
When decoding a file space info message in H5O__fsinfo_decode() make
sure each element to be decoded is still within the message. Malformed
hdf5 files may have trunkated content which does not match the
expected size. Checking this will prevent attempting to decode
unrelated data and heap overflows. So far, only free space manager
address data was checked before decoding.

This fixes CVE-2021-45830 / Bug #2228.

Signed-off-by: Egbert Eich <eich@suse.com>

Additions

Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
@derobins derobins removed the bug label Mar 3, 2023
@derobins derobins changed the title [BUG, CVE-2021-45830] Heap Buffer Overflow in H5F_addr_decode_len() [CVE-2021-45830] Heap Buffer Overflow in H5F_addr_decode_len() May 4, 2023
@derobins derobins added Priority - 1. High 🔼 These are important issues that should be resolved in the next release Component - C Library Core C library issues (usually in the src directory) Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub labels May 4, 2023
@byrnHDF
Copy link
Contributor

byrnHDF commented Jun 13, 2023

See #1314

@byrnHDF byrnHDF closed this as completed Jun 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@byrnHDF byrnHDF

Labels
Component - C Library Core C library issues (usually in the src directory) Priority - 1. High 🔼 These are important issues that should be resolved in the next release Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@derobins @e4t @byrnHDF