CVE-2024-32624

What it actually does

Heap-based buffer overflow in H5T__ref_mem_setnull (called via H5T__conv_ref) corrupts the instruction pointer during reference type conversion in the HDF5 library.

Why it matters to the business

Chromium packages on Debian 11 using the vulnerable HDF5 code may experience crashes or potential remote code execution when processing certain inputs, with low likelihood indicated by stable low EPSS and no KEV listing.

How an attack unfolds

An attacker crafts input that triggers reference type conversion in HDF5, overflowing the heap buffer in H5T__ref_mem_setnull to corrupt the instruction pointer and potentially execute arbitrary code.

How to fix it

Upgrade the chromium package on Debian 11 to version 114.0.5735.133-1~deb11u1 or later to address the embedded HDF5 vulnerability.

How to confirm the fix worked

Confirm the installed chromium package version matches or exceeds 114.0.5735.133-1~deb11u1 and test that HDF5 reference conversion functions no longer exhibit overflow behavior with crafted inputs.

Typical attack path

1. Supply malicious HDF5-derived data to the affected application
2. Trigger H5T__conv_ref during type handling
3. Cause overflow in H5T__ref_mem_setnull to corrupt instruction pointer
4. Achieve code execution or denial of service

How to detect it

Monitor application logs and crash reports for errors involving H5Tref.c or H5Tconv.c functions when processing untrusted inputs; no widespread exploitation observed given absence from KEV.

What your security team should do

• Apply the Debian chromium package update to the fixed version without delay
• Scan environments for any remaining vulnerable HDF5 library versions
• Review application logs for HDF5 processing errors after patching