CVE-2020-36152

Vulnerability

A stack buffer overflow exists in the readDataVar function in hdf/dataobject.c of Symonics libmysofa versions 0.5 through 1.1. The bug stems from incorrect use of sprintf on a buffer that is too small, leading to a 4-byte overflow on the stack. The vulnerable code path is reachable when processing a specially crafted SOFA file, which triggers the overflow during the reading of HDF data variables.

Exploitation

An attacker must deliver a malicious SOFA file to a user or application that parses it using a vulnerable libmysofa version. No special network position or authentication beyond the ability to provide the file is required. The overflow occurs when readDataVar constructs a string using sprintf with a format like "REF%08lX" into a fixed-size buffer; a crafted file causes the output to exceed the buffer size, overwriting adjacent stack data as shown in GDB traces from the advisory [1].

Impact

Successful exploitation allows an attacker to corrupt stack variables, potentially leading to arbitrary code execution with the privileges of the process consuming the SOFA file. Depending on stack protection mechanisms, the overflow may also cause logic errors or a denial-of-service crash.

Mitigation

The issue was fixed in libmysofa version 1.2, released after the vulnerability was disclosed. Users should upgrade to 1.2 or later. No workaround is available; the only mitigation is to update the library. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.