Scale Offset Filter
Monthly
HDF5 through 2.2.0 discloses process heap memory when an application opens and reads a dataset that uses the scaleoffset filter from a crafted file whose filtered chunk record is truncated. The decode path in H5Z__filter_scaleoffset() validates reads against the allocated size of the chunk buffer instead of the number of bytes actually stored, and because H5D__chunk_lock() sizes that buffer to the larger of the stored and unfiltered chunk sizes while filling only the stored bytes, the truncated chunk passes the bounds check and the uninitialized remainder is decompressed and returned as dataset data. The vulnerability is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), requires the victim to open and read the crafted file, and is limited to confidentiality impact with no code execution, modification, or crash; an upstream fix exists in PR 6585 but no released patched version is confirmed, and no public exploit has been identified.
HDF5 through 2.2.0 discloses process heap memory when an application opens and reads a dataset that uses the scaleoffset filter from a crafted file whose filtered chunk record is truncated. The decode path in H5Z__filter_scaleoffset() validates reads against the allocated size of the chunk buffer instead of the number of bytes actually stored, and because H5D__chunk_lock() sizes that buffer to the larger of the stored and unfiltered chunk sizes while filling only the stored bytes, the truncated chunk passes the bounds check and the uninitialized remainder is decompressed and returned as dataset data. The vulnerability is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), requires the victim to open and read the crafted file, and is limited to confidentiality impact with no code execution, modification, or crash; an upstream fix exists in PR 6585 but no released patched version is confirmed, and no public exploit has been identified.