Buffer Overflow in H5A__close at H5Aint.c

[cyberitech]

Buffer Overflow in H5A__close at H5Aint.c

Software version: git commit tag hdf5_1_14_0
OS: Ubuntu 18.04.6 LTS
Compiler: clang

Build steps:

./configure --disable-shared --enable-static-exec && make

Build options: None needed besides default

Command: tools/src/h5diff/h5diff plain_model.h5 malformed.h5
plain_model.h5 and malformed.h5 are present in poc.zip

Stack trace:

Starting program: /home/ubuntu/hd5f/hdf5-1.14.0/tools/src/h5diff/h5diff /home/ubuntu/hd5f/hdf5-1.14.0/fuzzing/h5diff/in/plain_model.h5 id:000002,sig:11,src:000000,op:havoc,rep:8

Program received signal SIGSEGV, Segmentation fault.
0x0000000000473f9f in H5A__close (attr=0xebafd0) at H5Aint.c:1336
1336	    if (attr->shared->nrefs <= 1) {
(gdb) bt
#0  0x0000000000473f9f in H5A__close (attr=0xebafd0) at H5Aint.c:1336
#1  0x00000000006449f8 in H5O__attr_free (mesg=0xebafd0) at H5Oattr.c:515
#2  0x000000000067b26c in H5O_msg_free_real (type=0xb3d8f0 <H5O_MSG_ATTR>, msg_native=0xebafd0) at H5Omessage.c:684
#3  H5O__msg_free_mesg (mesg=0xeb15b8) at H5Omessage.c:654
#4  0x00000000006699ed in H5O__free (oh=0xeb24b0, force=<optimized out>) at H5Oint.c:3049
#5  0x000000000064da00 in H5O__cache_free_icr (_thing=0xebafd0) at H5Ocache.c:641
#6  0x00000000004a4e1f in H5C__flush_single_entry (f=<optimized out>, entry_ptr=0xeb24b0, flags=98336) at H5C.c:6936
#7  0x00000000004a2784 in H5C__flush_invalidate_ring (f=<optimized out>, ring=<optimized out>, flags=<optimized out>) at H5C.c:5860
#8  H5C__flush_invalidate_cache (f=<optimized out>, flags=<optimized out>) at H5C.c:5381
#9  0x00000000004a1205 in H5C_dest (f=0xea3610) at H5C.c:809
#10 0x000000000047d659 in H5AC_dest (f=0xea3610) at H5AC.c:518
#11 0x000000000054e4d0 in H5F__dest (f=0xea3610, flush=true) at H5Fint.c:1513
#12 0x000000000054fd65 in H5F_try_close (f=0xea3610, was_closed=0x0) at H5Fint.c:2521
#13 0x000000000054f92d in H5F__close (f=0xea3610) at H5Fint.c:2323
#14 0x000000000094c2d6 in H5VL__native_file_close (file=0xea3610, dxpl_id=<optimized out>, req=<optimized out>) at H5VLnative_file.c:782
#15 0x000000000092c342 in H5VL__file_close (obj=<optimized out>, cls=<optimized out>, dxpl_id=<optimized out>, req=<optimized out>) at H5VLcallback.c:4309
#16 H5VL_file_close (vol_obj=0xea6190, dxpl_id=792633534417207304, req=0x0) at H5VLcallback.c:4340
#17 0x00000000005546ad in H5F__close_cb (file_vol_obj=0xea6190, request=0xe47c10 <__afl_area_initial>) at H5Fint.c:215
#18 0x00000000006186d3 in H5I__dec_ref (id=72057594037927937, request=0x0) at H5Iint.c:1034
#19 0x00000000006188ff in H5I__dec_app_ref (id=72057594037927937, request=0xeb1558) at H5Iint.c:1106
#20 0x000000000061884a in H5I_dec_app_ref (id=15445968) at H5Iint.c:1154
#21 0x000000000053a7ed in H5Fclose (file_id=72057594037927937) at H5F.c:1059
#22 0x0000000000436f7d in h5diff (fname1=<optimized out>, fname2=<optimized out>, objname1=<optimized out>, objname2=<optimized out>, opts=<optimized out>) at h5diff.c:1085
#23 0x0000000000400d47 in main (argc=<optimized out>, argv=<optimized out>) at h5diff_main.c:98

For what its worth, I've also confirmed that this vulnerability manifests when loading the supplied model into tensorflow, causing a sigsev in the backend hdf5 c extension tf uses. given the recent wide proliferation of machine learning models to the public, and the fact this bug manifests using common ML frameworks like python tensorflow, it may be worth some degree of prioritization for fixing

[derobins]

This might be fixed after the latest round of file I/O hardening. We'll investigate.

[derobins]

This is not fixed in hdf5_1_14 or develop.

FWIW, the training_config attribute on the root group is corrupt. h5dump -a /training_config flawed.h5 fails normally, but h5diff is taking a different code path.

[derobins]

This is fixed after #4234, which will be released in 1.14.4.