CVE-2024-33875: 
NixOS vulnerability analysis and mitigation

HDF5 Library through version 1.14.3 contains a heap-based buffer overflow vulnerability in the H5O__layout_encode function within H5Olayout.c. This vulnerability was discovered and disclosed in May 2024, and it affects all versions of the HDF5 Library up to and including version 1.14.3. The vulnerability results in the corruption of the instruction pointer (HDF Group).

The vulnerability is classified as a heap-based buffer overflow occurring specifically in the H5O__layout_encode function within the H5Olayout.c file. The CVSS v3.1 score assigned by CISA-ADP is 5.7 (Medium), with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. The vulnerability is categorized under CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (NVD).

When exploited, this vulnerability leads to the corruption of the instruction pointer, which can result in denial of service or potential code execution. The impact primarily affects the integrity and availability of the system, with low impact on confidentiality (CISA-ADP).

The vulnerability requires local access with high attack complexity. No user interaction is required for exploitation, and no privileges are needed. The vulnerability has been fixed in version 1.14.4 of the HDF5 Library (HDF Group).

The vulnerability has been fixed in HDF5 version 1.14.4, released on April 15, 2024. Users are advised to upgrade to this version or later to mitigate the vulnerability. The fix has been incorporated into the HDF5 CVE test repository, which includes test scripts that are run on every HDF5 pull request to prevent similar issues (HDF Group).