PT-2021-21415 · Matio+1 · Matio+1

Published 2021-07-20 · Updated 2022-12-13 · CVE-2021-36977

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions matio (aka MAT File I/O Library) versions 1.5.20 through 1.5.21

Description The issue is related to a heap-based buffer overflow in the H5MM memcpy function, which is called from H5MM malloc and H5C load entry. This overflow is associated with the use of HDF5 version 1.12.0.

Recommendations For matio versions 1.5.20 and 1.5.21, consider restricting the use of the H5MM memcpy function until a patch is available. As a temporary workaround, avoid using the H5MM malloc and H5C load entry functions that call H5MM memcpy to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-36977

MGASA-2022-0465

OPENSUSE-SU-2022:10235-1

Affected Products

Hdf5

Matio

References · 21

• https://github.com/google/oss-fuzz-vulns/commit/37b781ace1b4228fc36483bb7e30c72ea9d4c3d6 · Patch
• https://osv.dev/vulnerability/MGASA-2022-0465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36977 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10235-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36977 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0465.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36977 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-36977 · Security Note
• https://ubuntu.com/security/CVE-2021-36977 · Vendor Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265 · Patch
• https://github.com/google/oss-fuzz/issues/4999 · Note
• https://github.com/HDFGroup/hdf5/issues/272 · Note
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440.yaml · Note
• https://bugs.mageia.org/show_bug.cgi?id=31246 · Note
• https://t.me/cvenotify/18214 · Telegram Post