CVE-2020-6860

Vulnerability

libmysofa version 0.9.1 contains a stack-based buffer overflow in the readDataVar function within hdf/dataobject.c. The vulnerability occurs during the parsing of a header message attribute when processing a crafted HDF file. The overflow is triggered by an unbounded sprintf call that writes data into a fixed-size stack buffer, as demonstrated by AddressSanitizer output showing a write of size 20 beyond the buffer boundary [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted HDF file to the mysofa2json utility or any application that uses the libmysofa library to parse HDF files. No authentication or special privileges are required; the attacker only needs to convince a user or automated process to open the malicious file. The overflow occurs during the normal parsing flow, specifically in readDataVar at line 555 of dataobject.c, when processing attribute data [1].

Impact

Successful exploitation of the stack-based buffer overflow can lead to memory corruption, potentially allowing an attacker to execute arbitrary code in the context of the affected process. The AddressSanitizer trace confirms a stack buffer overflow, which could be leveraged for control-flow hijacking or denial of service [1].

Mitigation

As of the available references, no official patch or fixed version has been disclosed for CVE-2020-6860. Users are advised to monitor the libmysofa repository for updates and consider limiting the processing of untrusted HDF files until a fix is released [1].