CVE-2024-32605

What it actually does

The vulnerability permits a heap-based buffer over-read in H5VM_memcpyvv during compact dataset reads, allowing out-of-bounds memory access that can leak adjacent heap contents or trigger crashes.

Why it matters to the business

Scientific and data-processing applications using HDF5 risk crashes or exposure of sensitive in-memory data when handling untrusted files, potentially halting research workflows and compromising dataset confidentiality.

How an attack unfolds

An attacker creates a malicious HDF5 file that triggers the compact read path in H5Dcompact.c, causing the library to perform an over-read via H5VM_memcpyvv and either leak memory or crash the process.

How to fix it

Upgrade hdfgroup/hdf5 to the fixed commit 88429b015e29c59de604b0f552001fb7cb7ed5d0 or a later release; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the installed HDF5 library reports a version containing commit 88429b015e29c59de604b0f552001fb7cb7ed5d0 and test parsing of compact datasets with both valid and edge-case files.

Typical attack path

1. Craft a malicious HDF5 file with malformed compact dataset layout
2. Deliver the file to a vulnerable application or service
3. Trigger HDF5 parsing of the compact dataset
4. Execute the over-read to leak memory or induce denial of service

How to detect it

Review application and system logs for segmentation faults or memory-access errors originating from HDF5 compact read functions when untrusted files are processed.

What your security team should do

• Immediately update all instances of HDF5 to the patched commit
• Inventory and replace vulnerable HDF5 binaries in build pipelines and containers
• Restrict processing of untrusted HDF5 files until patches are applied