PT-2018-3951 · Hdf5+4 · Hdf5+4

Published 2018-09-20 · Updated 2023-08-09 · CVE-2018-17237

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HDF5 version 1.10.3

Description The issue arises from incorrect protection against division by zero in the H5D chunk set info real() function of the H5Dchunk.c component in the HDF5 library. This can lead to a SIGFPE signal being raised when attempting to parse a crafted HDF file. The vulnerability may allow a remote attacker to cause a denial of service using a specially crafted HDF file.

Recommendations For HDF5 version 1.10.3, consider applying a patch or fix that addresses the division by zero issue in the H5D chunk set info real() function to prevent potential denial of service attacks.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BDU:2023-07648

CVE-2018-17237

DLA-3522-1

OPENSUSE-SU-2022_1912-1

SUSE-SU-2022:1903-1

SUSE-SU-2022:1910-1

SUSE-SU-2022:1911-1

SUSE-SU-2022:1912-1

SUSE-SU-2022:1933-1

USN-5272-1

Affected Products

Astra Linux

Hdf5

Linuxmint

Suse

Ubuntu

References · 154

• 🔥 https://github.com/SegfaultMasters/covering360/blob/master/HDF5/README.md#divided-by-zero---h5d__chunk_set_info_real_div_by_zero · Exploit
• 🔥 https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_h5d__select_io_h5dselect · Exploit
• 🔥 https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_apply_filters_h5repack_filters · Exploit
• 🔥 https://github.com/Twi1ight/fuzzing-pocs/tree/master/hdf5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17237 · Security Note
• https://ubuntu.com/security/CVE-2018-17237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07648 · Security Note
• https://ubuntu.com/security/CVE-2018-17234 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=283904092 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07611 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17233 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1910-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1903-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07614 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory