CVE-2020-10812: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in HDF5 through version 1.12.0. The vulnerability exists in the function H5F_get_nrefs() located in H5Fquery.c. This vulnerability was assigned CVE-2020-10812 and was disclosed on March 22, 2020 (NVD, Loginsoft Research).

The vulnerability occurs when the function H5VL__native_file_close() calls H5F_get_nrefs() located in H5Fquery.c to retrieve the file's 'nrefs' value. The issue arises in the FUNC_LEAVE_NOAPI(f->shared->nrefs) line where f->shared is pointing to null, triggering a null pointer dereference. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) (NVD).

When exploited, this vulnerability allows an attacker to cause a Denial of Service condition in the application. The vulnerability can be triggered by sending a crafted file to the h5debug binary (Loginsoft Research).

Users should upgrade to a version newer than HDF5 1.12.0 to address this vulnerability. The fix involves proper null pointer checking before accessing the shared->nrefs value in the H5F_get_nrefs() function (HDF Release Notes).