CVE-2024-32617

What it actually does

Heap-based buffer over-read triggered by unsafe strdup call in H5MM_xstrdup during link/group entry processing in HDF5 files.

Why it matters to the business

Applications that read HDF5 files from untrusted sources may crash or disclose adjacent memory contents, disrupting data analysis workflows and potentially exposing sensitive information.

How an attack unfolds

An attacker supplies a specially crafted HDF5 file containing a malformed group link entry; when the library parses it via H5G__ent_to_link, the unsafe strdup triggers an out-of-bounds read on the heap.

How to fix it

Upgrade hdfgroup/hdf5 to the commit 88429b015e29c59de604b0f552001fb7cb7ed5d0 or later; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the installed library reports a commit newer than 88429b015e29c59de604b0f552001fb7cb7ed5d0; run regression tests with previously crashing HDF5 test files.

Typical attack path

1. Attacker creates HDF5 file with oversized or malformed link entry metadata
2. Victim application opens the file using an affected HDF5 library version
3. H5G__ent_to_link invokes H5MM_xstrdup on attacker-controlled data
4. Over-read occurs, potentially crashing the process or leaking memory

How to detect it

Monitor application logs and crash reports for segmentation faults or memory errors during HDF5 file parsing; correlate with file opens from external or untrusted sources.

What your security team should do

• Prioritize patching all HDF5-dependent software within the next maintenance window
• Scan build pipelines and containers for versions through 1.14.3
• Add HDF5 upgrade to the next scheduled dependency audit