Description
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
samtools htslib
Default version status: unaffected
0 to ≤ 1.24affected
pkg:github/samtools/htslibReferences
- https://github.com/samtools/htslib/pull/2057 ↗
- https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873 ↗
- https://github.com/samtools/htslib ↗
- https://github.com/samtools/htslib/blob/1.24/bgzf.c#L2504 ↗
- https://hackmd.io/@haindpwn/htslib-bgzf-gzi-int-truncation-oob ↗
- https://github.com/samtools/htslib/issues/2113 ↗
- https://www.vulncheck.com/advisories/htslib-through-1.24-heap-out-of-bounds-write-via-truncated-gzi-index-count ↗