Bug 1224158 (CVE-2024-33877) - VUL-0: hdf5: multiple CVEs
Summary: VUL-0: hdf5: multiple CVEs
Status: NEW
Alias: CVE-2024-33877
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/404981/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-29158:5.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-13 07:26 UTC by Carlos López
Modified: 2024-06-25 12:30 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2024-05-13 07:26:02 UTC 
The following 35 vulnerabilities were published for hdf5:
https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/

CVE-2024-33877
| HDF5 Library through 1.14.3 has a heap-based buffer overflow in
| H5T__conv_struct_opt in H5Tconv.c.

CVE-2024-33876
| HDF5 Library through 1.14.3 has a heap buffer overflow in
| H5S__point_deserialize in H5Spoint.c.

CVE-2024-33875
| HDF5 Library through 1.14.3 has a heap-based buffer overflow in
| H5O__layout_encode in H5Olayout.c, resulting in the corruption of
| the instruction pointer.

CVE-2024-33874
| HDF5 Library through 1.14.3 has a heap buffer overflow in
| H5O__mtime_new_encode in H5Omtime.c.

CVE-2024-33873
| HDF5 Library through 1.14.3 has a heap-based buffer overflow in
| H5D__scatter_mem in H5Dscatgath.c.

CVE-2024-32624
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5T__ref_mem_setnull in H5Tref.c (called from H5T__conv_ref in
| H5Tconv.c), resulting in the corruption of the instruction pointer.

CVE-2024-32623
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5VM_array_fill in H5VM.c (called from H5S_select_elements in
| H5Spoint.c).

CVE-2024-32622
| HDF5 Library through 1.14.3 contains a out-of-bounds read operation
| in H5FL_arr_malloc in H5FL.c (called from H5S_set_extent_simple in
| H5S.c).

CVE-2024-32621
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5HG_read in H5HG.c (called from H5VL__native_blob_get in
| H5VLnative_blob.c), resulting in the corruption of the instruction
| pointer.

CVE-2024-32620
| HDF5 Library through 1.14.3 contains a heap-based buffer over-read
| in H5F_addr_decode_len in H5Fint.c, resulting in the corruption of
| the instruction pointer.

CVE-2024-32619
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5T_copy_reopen in H5T.c, resulting in the corruption of the
| instruction pointer.

CVE-2024-32618
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5T__get_native_type in H5Tnative.c, resulting in the corruption of
| the instruction pointer.

CVE-2024-32617
| HDF5 Library through 1.14.3 contains a heap-based buffer over-read
| caused by the unsafe use of strdup in H5MM_xstrdup in H5MM.c (called
| from H5G__ent_to_link in H5Glink.c).

CVE-2024-32616
| HDF5 Library through 1.14.3 contains a heap-based buffer over-read
| in H5O__dtype_encode_helper in H5Odtype.c.

CVE-2024-32615
| HDF5 Library through 1.14.3 contains a heap-based buffer overflow in
| H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier
| use of an initialized pointer.

CVE-2024-32614
| HDF5 Library through 1.14.3 has a SEGV in H5VM_memcpyvv in H5VM.c.

CVE-2024-32613
| HDF5 Library through 1.14.3 contains a heap-based buffer over-read
| in the function H5HL__fl_deserialize in H5HLcache.c, a different
| vulnerability than CVE-2024-32612.

CVE-2024-32612
| HDF5 Library through 1.14.3 contains a heap-based buffer over-read
| in H5HL__fl_deserialize in H5HLcache.c, resulting in the corruption
| of the instruction pointer, a different vulnerability than
| CVE-2024-32613.

CVE-2024-32611
| HDF5 Library through 1.14.3 may use an uninitialized value in
| H5A__attr_release_table in H5Aint.c.

CVE-2024-32610
| HDF5 Library through 1.14.3 has a SEGV in H5T_close_real in H5T.c,
| resulting in a corrupted instruction pointer.

CVE-2024-32609
| HDF5 Library through 1.14.3 allows stack consumption in the function
| H5E_printf_stack in H5Eint.c.

CVE-2024-32608
| HDF5 library versions <=1.14.3 contain a memory corruption in 
| H5A__close resulting in the corruption of the instruction pointer 
| and causing denial of service or potential code execution.

CVE-2024-32607
| HDF5 Library through 1.14.3 has a SEGV in H5A__close in H5Aint.c,
| resulting in the corruption of the instruction pointer.

CVE-2024-32606
| HDF5 Library through 1.14.3 may attempt to dereference uninitialized
| values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from
| h5tools_dump_simple_data in tools/lib/h5tools_dump.c).

CVE-2024-32605
| HDF5 Library through 1.14.3 has a heap-based buffer over-read in
| H5VM_memcpyvv in H5VM.c (called from H5D__compact_readvv in
| H5Dcompact.c).

CVE-2024-29166
| HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode,
| resulting in the corruption of the instruction pointer and causing
| denial of service or potential code execution.

CVE-2024-29165
| HDF5 through 1.14.3 contains a buffer overflow in
| H5Z__filter_fletcher32, resulting in the corruption of the
| instruction pointer and causing denial of service or potential code
| execution.

CVE-2024-29164
| HDF5 through 1.14.3 contains a stack buffer overflow in
| H5R__decode_heap, resulting in the corruption of the instruction
| pointer and causing denial of service or potential code execution.

CVE-2024-29163
| HDF5 through 1.14.3 contains a heap buffer overflow in
| H5T__bit_find, resulting in the corruption of the instruction
| pointer and causing denial of service or potential code execution.

CVE-2024-29162
| HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow
| in H5HG_read, resulting in denial of service or potential code
| execution.

CVE-2024-29161
| HDF5 through 1.14.3 contains a heap buffer overflow in
| H5A__attr_release_table, resulting in the corruption of the
| instruction pointer and causing denial of service or potential code
| execution.

CVE-2024-29160
| HDF5 through 1.14.3 contains a heap buffer overflow in
| H5HG__cache_heap_deserialize, resulting in the corruption of the
| instruction pointer and causing denial of service or potential code
| execution.

CVE-2024-29159
| HDF5 through 1.14.3 contains a buffer overflow in
| H5Z__filter_scaleoffset, resulting in the corruption of the
| instruction pointer and causing denial of service or potential code
| execution.

CVE-2024-29158
| HDF5 through 1.14.3 contains a stack buffer overflow in
| H5FL_arr_malloc, resulting in the corruption of the instruction
| pointer and causing denial of service or potential code execution.

CVE-2024-29157
| HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read,
| resulting in the corruption of the instruction pointer and causing
| denial of service or potential code execution.


References:
https://bugzilla.redhat.com/show_bug.cgi?id=2280037
Comment 6 Egbert Eich 2024-06-19 11:33:17 UTC 
The Maintenance incidents are:
12SP2: 34244
15SP2: 27829
15SP3: 34207
15SP4: 28369

Assigning back to the security team.
Comment 7 Maintenance Automation 2024-06-20 12:30:01 UTC 
SUSE-SU-2024:2105-1: An update that solves 13 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1133222, 1224158
CVE References: CVE-2017-17507, CVE-2018-11205, CVE-2024-29158, CVE-2024-29161, CVE-2024-29166, CVE-2024-32608, CVE-2024-32610, CVE-2024-32614, CVE-2024-32619, CVE-2024-32620, CVE-2024-33873, CVE-2024-33874, CVE-2024-33875
Maintenance Incident: [SUSE:Maintenance:34244](https://smelt.suse.de/incident/34244/)
Sources used:
HPC Module 12 (src):
 hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-3.24.1, hdf5_1_10_11-gnu-hpc-1.10.11-3.24.1, hdf5_1_10_11-gnu-openmpi1-hpc-1.10.11-3.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Maintenance Automation 2024-06-25 12:30:21 UTC 
SUSE-SU-2024:2195-1: An update that solves 13 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1224158
CVE References: CVE-2017-17507, CVE-2018-11205, CVE-2024-29158, CVE-2024-29161, CVE-2024-29166, CVE-2024-32608, CVE-2024-32610, CVE-2024-32614, CVE-2024-32619, CVE-2024-32620, CVE-2024-33873, CVE-2024-33874, CVE-2024-33875
Maintenance Incident: [SUSE:Maintenance:34207](https://smelt.suse.de/incident/34207/)
Sources used:
openSUSE Leap 15.3 (src):
 pmix-3.2.3-150300.3.10.1
openSUSE Leap 15.4 (src):
 hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1
openSUSE Leap 15.5 (src):
 mvapich2-psm-2.3.7-150500.3.2.1, mpich-ofi_4_0_2-gnu-hpc-testsuite-4.0.2-150500.3.2.1, mpich_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, mpich-ofi-4.0.2-150500.3.2.1, mvapich2_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, mvapich2-psm2-2.3.7-150500.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, lua53-luaterm-0.07-150000.5.5.1, lua51-luaterm-0.07-150000.5.5.1, lua51-luaposix-34.1.1-150200.3.5.1, mpich-testsuite-4.0.2-150500.3.2.1, openmpi4-testsuite-4.1.4-150500.3.2.1, mvapich2-psm2_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, mpich-ofi-testsuite-4.0.2-150500.3.2.1, mpich-ofi_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, mpich_4_0_2-gnu-hpc-testsuite-4.0.2-150500.3.2.1, openmpi_4_1_4-gnu-hpc-testsuite-4.1.4-150500.3.2.1, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, mvapich2-2.3.7-150500.3.2.1, mvapich2-psm_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, openmpi4-4.1.4-150500.3.2.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, openmpi_4_1_4-gnu-hpc-4.1.4-150500.3.2.1, mpich-4.0.2-150500.3.2.1
openSUSE Leap 15.6 (src):
 mvapich2-psm-2.3.7-150500.3.2.1, mpich-ofi_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, mpich_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, lua53-luaterm-0.07-150000.5.5.1, mpich-ofi-testsuite-4.1.2-150600.3.2.2, lua51-luaterm-0.07-150000.5.5.1, lua51-luaposix-34.1.1-150200.3.5.1, mpich-testsuite-4.1.2-150600.3.2.2, mvapich2-psm2-2.3.7-150600.9.2.1, mpich-ofi_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, mvapich2_2_3_7-gnu-hpc-2.3.7-150600.9.2.2, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, openmpi_4_1_4-gnu-hpc-4.1.4-150500.3.2.1, openmpi4-testsuite-4.1.6-150600.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, mpich-ofi_4_1_2-gnu-hpc-testsuite-4.1.2-150600.3.2.2, mpich_4_1_2-gnu-hpc-testsuite-4.1.2-150600.3.2.2, hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, mpich-ofi-4.1.2-150600.3.2.1, mvapich2-2.3.7-150600.9.2.1, openmpi_4_1_6-gnu-hpc-4.1.6-150600.3.2.1, mpich_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, openmpi_4_1_4-gnu-hpc-testsuite-4.1.4-150500.3.2.1, openmpi_4_1_6-gnu-hpc-testsuite-4.1.6-150600.3.2.1, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, mvapich2-psm_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, mvapich2_2_3_7-gnu-hpc-2.3.7-150600.9.2.1, mpich-4.1.2-150600.3.2.1, mvapich2-psm2_2_3_7-gnu-hpc-2.3.7-150600.9.2.1, openmpi4-4.1.6-150600.3.2.1
HPC Module 15-SP5 (src):
 mpich-ofi_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, mpich_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, mvapich2_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, mvapich2-psm_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, openmpi_4_1_4-gnu-hpc-4.1.4-150500.3.2.1, mvapich2-psm2_2_3_7-gnu-hpc-2.3.7-150500.3.2.1
HPC Module 15-SP6 (src):
 hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, mpich-ofi_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, pmix-3.2.3-150300.3.10.1, openmpi_4_1_6-gnu-hpc-4.1.6-150600.3.2.1, mpich_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, mvapich2_2_3_7-gnu-hpc-2.3.7-150600.9.2.1, mvapich2-psm2_2_3_7-gnu-hpc-2.3.7-150600.9.2.1
SUSE Package Hub 15 15-SP5 (src):
 mpich-ofi_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, mpich_4_0_2-gnu-hpc-4.0.2-150500.3.2.1, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, mvapich2_2_3_7-gnu-hpc-2.3.7-150500.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, openmpi_4_1_4-gnu-hpc-4.1.4-150500.3.2.1, lua53-luafilesystem-1.7.0-150000.3.5.1
SUSE Package Hub 15 15-SP6 (src):
 hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, mpich-ofi_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, openmpi_4_1_6-gnu-hpc-4.1.6-150600.3.2.1, mpich_4_1_2-gnu-hpc-4.1.2-150600.3.2.1, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, mvapich2_2_3_7-gnu-hpc-2.3.7-150600.9.2.1, lua53-luafilesystem-1.7.0-150000.3.5.1
Server Applications Module 15-SP5 (src):
 mvapich2-2.3.7-150500.3.2.1, openmpi4-4.1.4-150500.3.2.1, mvapich2-psm-2.3.7-150500.3.2.1, mpich-4.0.2-150500.3.2.1, mpich-ofi-4.0.2-150500.3.2.1, mvapich2-psm2-2.3.7-150500.3.2.1
Server Applications Module 15-SP6 (src):
 mvapich2-psm2-2.3.7-150600.9.2.1, mpich-ofi-4.1.2-150600.3.2.1, mvapich2-2.3.7-150600.9.2.1, mpich-4.1.2-150600.3.2.1, openmpi4-4.1.6-150600.3.2.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 lua53-luaterm-0.07-150000.5.5.1, lua53-luaposix-34.1.1-150200.3.5.1, lua53-luafilesystem-1.7.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 lua53-luaterm-0.07-150000.5.5.1, lua53-luaposix-34.1.1-150200.3.5.1, lua53-luafilesystem-1.7.0-150000.3.5.1, pmix-3.2.3-150300.3.10.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, lua53-luafilesystem-1.7.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 hdf5_1_10_11-gnu-mvapich2-hpc-1.10.11-150400.3.17.2, pmix-3.2.3-150300.3.10.1, hdf5_1_10_11-gnu-openmpi3-hpc-1.10.11-150400.3.17.2, lua53-luaposix-34.1.1-150200.3.5.1, hdf5_1_10_11-gnu-mpich-hpc-1.10.11-150400.3.17.2, hdf5_1_10_11-gnu-hpc-1.10.11-150400.3.17.1, lua53-luaterm-0.07-150000.5.5.1, hdf5_1_10_11-gnu-openmpi4-hpc-1.10.11-150400.3.17.2, lua53-luafilesystem-1.7.0-150000.3.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.