CyberRota Analysis
AI-GeneratedThe vulnerability affects the HDF5 library, specifically in the handling of chunked datasets where the dimensionality of the stored chunk layout is not validated against the dataspace rank upon opening existing datasets. This oversight can lead to a denial of service, resulting in application crashes when processing specially crafted HDF5 files. Organizations utilizing HDF5, particularly those in data-intensive fields, should prioritize addressing this issue to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.