Bug 1567121 (CVE-2018-2814)

Summary: CVE-2018-2814 OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: dbhole, jvanek, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=critical,public=20180417,reported=20180323,source=oracle,cvss3=7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,rhel-6/java-1.7.0-openjdk=affected/impact=important,rhel-7/java-1.7.0-openjdk=affected/impact=important,rhel-6/java-1.8.0-openjdk=affected,rhel-7/java-1.8.0-openjdk=affected,rhel-6/java-1.6.0-sun=affected,rhel-7/java-1.6.0-sun=affected,rhel-6/java-1.7.0-oracle=affected,rhel-7/java-1.7.0-oracle=affected,rhel-6/java-1.8.0-oracle=affected,rhel-7/java-1.8.0-oracle=affected
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-05-03 12:28:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1559768, 1559769, 1559770, 1559771, 1559773, 1559774, 1559775, 1559776, 1565346, 1565347, 1565348, 1565349, 1565350, 1565351, 1565352, 1565353, 1565511, 1565512, 1565513, 1565514    
Bug Blocks: 1559778    

Description Tomas Hoger 2018-04-13 13:01:26 UTC
A flaw was found in the way the Hotspot component of OpenJDK handled clones of the java.lang.ref.Reference objects.  An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2018-04-17 20:43:05 UTC
Public now via Oracle CPU April 2018:

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA

The issue was fixed in Oracle JDK 10.0.1, 8u171, 7u181, and 6u191.

Comment 2 errata-xmlrpc 2018-04-19 16:59:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1188 https://access.redhat.com/errata/RHSA-2018:1188

Comment 3 errata-xmlrpc 2018-04-19 18:00:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1191 https://access.redhat.com/errata/RHSA-2018:1191

Comment 4 Tomas Hoger 2018-04-20 20:45:15 UTC
OpenJDK-8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/08326a76b148

Comment 5 errata-xmlrpc 2018-04-23 17:11:29 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:1201 https://access.redhat.com/errata/RHSA-2018:1201

Comment 6 errata-xmlrpc 2018-04-23 17:14:40 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:1202 https://access.redhat.com/errata/RHSA-2018:1202

Comment 7 errata-xmlrpc 2018-04-23 17:17:14 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:1204 https://access.redhat.com/errata/RHSA-2018:1204

Comment 8 errata-xmlrpc 2018-04-23 17:19:41 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:1203 https://access.redhat.com/errata/RHSA-2018:1203

Comment 9 errata-xmlrpc 2018-04-23 17:21:44 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:1205 https://access.redhat.com/errata/RHSA-2018:1205

Comment 10 errata-xmlrpc 2018-04-23 17:29:34 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:1206 https://access.redhat.com/errata/RHSA-2018:1206

Comment 11 errata-xmlrpc 2018-04-30 16:17:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1270 https://access.redhat.com/errata/RHSA-2018:1270

Comment 12 errata-xmlrpc 2018-05-02 22:06:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1278 https://access.redhat.com/errata/RHSA-2018:1278