HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/samtools/htslib
disclosure@vulncheck.com
https://github.com/samtools/htslib/blob/1.24/bgzf.c#L2504
disclosure@vulncheck.com
https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2…
disclosure@vulncheck.com
https://github.com/samtools/htslib/issues/2113
disclosure@vulncheck.com
https://github.com/samtools/htslib/pull/2057
disclosure@vulncheck.com
https://hackmd.io/@haindpwn/htslib-bgzf-gzi-int-truncation-oob
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/htslib-through-1.24-heap-out-of-bounds-wri…
disclosure@vulncheck.com