Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2021-37501] buffer overflow in h5dump #2458

Closed
e4t opened this issue Feb 11, 2023 · 6 comments
Closed

[CVE-2021-37501] buffer overflow in h5dump #2458

e4t opened this issue Feb 11, 2023 · 6 comments
Assignees
@derobins @lrknox
Labels
Component - C Library Core C library issues (usually in the src directory) Priority - 0. Blocker ⛔ This MUST be merged for the release to happen Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub

Comments

@e4t
Copy link
Contributor

e4t commented Feb 11, 2023 •
edited
Loading

Describe the bug
CVE-2021-37501 (GHSA-rfgw-5vq3-wrjf) describes a buffer overflow in h5dump, a reproducer and description for this can be found in
https://github.com/ST4RF4LL/Something_Found.

The root cause is an artificially large size of a dimension in a dataspace message which causes the size of the on-disk data to exceed the addressable range and thus causes a multiplication to overflow.
In src/H5Oattr.c:H5O__attr_decode() with ds_size being set to 4611686018427387904 (0x4000000000000000) and dt_size equal to 8, the multiplication in:

H5_CHECKED_ASSIGN(attr->shared->data_size, size_t, ds_size * (hsize_t)dt_size, hsize_t);

overflows and is truncated to 0.
Since there is no provision to detect the overflow, the size is underestimated which will finally lead to a heap buffer overflow when the data is read with a subsequent segfault.

Expected behavior
The size overflow should be detected and the respective decode function should report an error so that the caller will terminate gracefully.

Platform

  • at least HDF5 1.10.8 and later (including current 'develop' branch)
  • openSUSE Leap 15.4/ SLE 15 SP4 / openSUSE Tumbleweed
  • gcc7
  • Autotools
  • configure --enable-fortran --enable-unsupported --enable-hl --enable-shared --enable-threadsafe --enable-build-mode=production --enable-cxx --with-pthread
@e4t e4t added the bug label Feb 11, 2023
e4t added a commit to e4t/hdf5 that referenced this issue Feb 11, 2023
@e4t
Check for overflow when calculating on-disk attribute data size (HDFG…
4d2c9b6 
…roup#2459)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication does not
overflow.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
@e4t e4t mentioned this issue Feb 11, 2023
Merged
e4t added a commit to e4t/hdf5 that referenced this issue Feb 13, 2023
@e4t
Check for overflow when calculating on-disk attribute data size (HDFG…
6f25c82 
…roup#2459)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication does not
overflow.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
e4t added a commit to e4t/hdf5 that referenced this issue Feb 13, 2023
@e4t
Check for overflow when calculating on-disk attribute data size (HDFG…
7d2e0bf 
…roup#2458)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication does not
overflow.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
e4t added a commit to e4t/hdf5 that referenced this issue Feb 13, 2023
@e4t
Check for overflow when calculating on-disk attribute data size (HDFG…
0b9d9bf 
…roup#2456)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication does not
overflow.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Feb 17, 2023
@bmwiedemann
Update hdf5 to version 1.12.2 / rev 81 via SR 1066251
3b318c5 
https://build.opensuse.org/request/show/1066251
by user eeich + dimstar_suse
- Fix CVE-2021-37501 - overflow in calculation of data buffer due to bogus
  input file (bsc#1207973).
  HDFGroup/hdf5#2458
  HDFGroup/hdf5#2459
  Check-for-overflow-when-calculating-on-disk-attribute-data-size-2459.patch
  Remove-duplicate-code.patch (forwarded request 1066178 from eeich)
e4t added a commit to e4t/hdf5 that referenced this issue Feb 25, 2023
@e4t @byrnHDF
Check for overflow when calculating on-disk attribute data size (HDFG…
a79aebd 
…roup#2459)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication hasn't
overflown.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
Co-authored-by: Allen Byrne <byrn@hdfgroup.org>
e4t added a commit to e4t/hdf5 that referenced this issue Feb 25, 2023
@e4t @byrnHDF
Check for overflow when calculating on-disk attribute data size (HDFG…
5698e13 
…roup#2459)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication hasn't
overflown.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
Co-authored-by: Allen Byrne <byrn@hdfgroup.org>
e4t added a commit to e4t/hdf5 that referenced this issue Feb 27, 2023
@e4t @byrnHDF
Check for overflow when calculating on-disk attribute data size (HDFG…
14b21d2 
…roup#2459)

A bogus hdf5 file may contain dataspace messages with sizes
which lead to the on-disk data sizes to exceed what is addressable.
When calculating the size, make sure, the multiplication hasn't
overflown.
The test case was crafted in a way that the overflow caused the
size to be 0.

This fixes CVE-2021-37501 / Bug HDFGroup#2458.

Signed-off-by: Egbert Eich <eich@suse.com>
Co-authored-by: Allen Byrne <byrn@hdfgroup.org>
@derobins derobins removed the bug label Mar 3, 2023
@Mingli-Yu
Copy link

Does the version 1.8.21 have the CVE-2021-37501 issue? Thanks!

@derobins derobins changed the title [BUG, CVE-2021-37501] buffer overflow in h5dump [CVE-2021-37501] buffer overflow in h5dump May 3, 2023
@derobins derobins added Priority - 1. High 🔼 These are important issues that should be resolved in the next release Component - C Library Core C library issues (usually in the src directory) Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub labels May 3, 2023
@derobins derobins self-assigned this May 4, 2023
@derobins
Copy link
Member

derobins commented May 4, 2023

Does the version 1.8.21 have the CVE-2021-37501 issue? Thanks!

Unfortunately, we no longer support HDF5 1.8

@Mingli-Yu
Copy link

Does the version 1.8.21 have the CVE-2021-37501 issue? Thanks!

Unfortunately, we no longer support HDF5 1.8

Could you help hint if the CVE-2021-37501 issue exist in hdf5 1.8.21 or not? Thanks!

@jhendersonHDF
Copy link
Collaborator

Does the version 1.8.21 have the CVE-2021-37501 issue? Thanks!

Unfortunately, we no longer support HDF5 1.8

Could you help hint if the CVE-2021-37501 issue exist in hdf5 1.8.21 or not? Thanks!

@Mingli-Yu, yes, this CVE issue exists in the 1.8.21 release, as well as 1.8.22 and 1.8.23.

@derobins derobins added Priority - 0. Blocker ⛔ This MUST be merged for the release to happen and removed Priority - 1. High 🔼 These are important issues that should be resolved in the next release labels Jun 30, 2023
@bmribler bmribler mentioned this issue Jul 3, 2023
Closed
@mattjala
Copy link
Contributor

mattjala commented Jul 3, 2023

The reproducer file can be found here

@lrknox
Copy link
Collaborator

lrknox commented Jul 3, 2023

Fixed by PR #2459 (develop). Fix merged to hdf5_1_10 by PR #2579, to hdf5_1_12 by PR #2581 and to hdf5_1_14 by PR #2582.

@lrknox lrknox closed this as completed Jul 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@derobins derobins

@lrknox lrknox

Labels
Component - C Library Core C library issues (usually in the src directory) Priority - 0. Blocker ⛔ This MUST be merged for the release to happen Type - Bug Please report security issues to help@hdfgroup.org instead of creating an issue on GitHub
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@derobins @e4t @lrknox @jhendersonHDF @Mingli-Yu @mattjala