Bug 1356971 (CVE-2016-3598)

Summary:	CVE-2016-3598 OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dbhole, jvanek, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-24 19:23:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1350028

Description Tomas Hoger 2016-07-15 12:00:04 UTC

A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument.  As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method.  An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2016-07-20 07:41:30 UTC

Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA

Comment 2 Tomas Hoger 2016-07-20 09:35:49 UTC

OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5e7489ac05f0

Comment 3 errata-xmlrpc 2016-07-20 12:13:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2016:1458 https://access.redhat.com/errata/RHSA-2016:1458

Comment 4 errata-xmlrpc 2016-07-21 10:21:53 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:1475 https://access.redhat.com/errata/RHSA-2016:1475

Comment 5 errata-xmlrpc 2016-07-27 11:43:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2016:1504 https://rhn.redhat.com/errata/RHSA-2016-1504.html

Comment 7 errata-xmlrpc 2016-08-10 16:56:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Supplementary

Via RHSA-2016:1589 https://rhn.redhat.com/errata/RHSA-2016-1589.html

Comment 8 errata-xmlrpc 2016-08-10 17:23:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary
  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2016:1588 https://rhn.redhat.com/errata/RHSA-2016-1588.html

Comment 9 errata-xmlrpc 2016-08-10 17:24:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary
  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2016:1587 https://rhn.redhat.com/errata/RHSA-2016-1587.html

Comment 10 errata-xmlrpc 2017-05-09 16:45:10 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 5.6
  Red Hat Satellite 5.7

Via RHSA-2017:1216 https://access.redhat.com/errata/RHSA-2017:1216