Vulnerability feed

Executive summary

The advisory says Eclipse OpenJ9 versions prior to 0.63.0 are affected by a flaw in the JITServer component that lets an attacker-controlled message descriptor cause the server to read out-of-bounds data. The advisory text provided does not state a severity rating, and it does not state a fixed version beyond the 0.63.0 threshold named in the description.

Technical summary

The flaw is a missing cross-field validation of attacker-controlled _size, _paddingSize, and _dataOffset values in a JITServer message data descriptor, which can make getPayloadSize() return a very large value and cause out-of-bounds reads. The advisory describes a malicious client as the attacker and implies a network-reachable JITServer connection, but a specific attack vector and authentication requirements are not stated. Affected versions are stated as prior to 0.63.0. The commit notes describe fixes that add DataDescriptor::validate(), limit _paddingSize to less than 4, limit _dataOffset to 0 or 4, require _size to be at least _paddingSize plus _dataOffset, cap messages at 256 parameters, and refuse messages larger than 1 GB, but the advisory does not state a workaround, a CVSS score, exploitation status, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/eclipse-openj9/openj9/pull/25009

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

Eclipse FoundationEclipseEclipse Foundation Eclipse OpenJ9Eclipse OpenJ9Eclipse JITServer