GDAL Vendored HDF-EOS Heap Buffer Overflow in SWinDims

Vulnerability Overview A heap buffer overflow vulnerability exists in GDAL's vendored HDF-EOS library. The vulnerability occurs in the function, specifically within the function. When processing HDF-EOS files, if the dimension name value is not enclosed in quotes, it leads to a heap buffer overflow. Scope of Impact Version: GDAL 3.13.0dev-4c681ad376 Commit: 4c681ad376 Impact: - Immediate: Heap buffer overflow can cause SIGSEGV, leading to denial of service (DoS). - Potential: Controlled heap out-of-bounds (OOB) writes. - Scope: Any application using GDAL's HDF4/HDF-EOS multidimensional API to open swath format files. Remediation No specific remediation steps are provided on the current page. However, it is recommended to update to the latest version or apply official patches. POC Code Exploitation Code ASAN Output ```plaintext ==17859==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x462007e249e at pc 0x732e06225f0 bp 0x7ffe32e06225ec in /usr/include/aarch64-linux-gnu/bits/string_fortified.h:140 WRITE of size 9 at 0x462007e249e thread T0 #0 0x732e06225ec in strcat /usr/include/aarch64-linux-gnu/bits/string_fortified.h:140 #1 0x732e09258c4 in SWinDims /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1880 #2 0x732e0966469 in HDF4SwathGroup::GetDimensions(char const*) const /home/roo/Desktop/gdal/gdal/ #3 0x732e09e9564 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #4 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #5 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #6 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #7 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #8 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #9 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #10 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #11 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #12 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #13 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #14 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #15 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #16 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #17 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #18 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #19 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #20 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #21 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #22 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #23 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #24 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #25 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #26 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #27 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #28 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #29 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #30 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #31 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #32 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #33 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #34 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #35 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #36 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #37 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #38 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #39 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #40 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #41 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #42 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #43 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #44 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #45 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps

Goal Reached Thanks to every supporter — we hit 100%!

GDAL Vendored HDF-EOS Heap Buffer Overflow in SWinDims

More from this source