Bug 1568586 (CVE-2018-2825)

Summary:	CVE-2018-2825 OpenJDK: insufficient array type checks in VarHandle (Libraries, 8194233)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dbhole, jvanek, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-17 20:28:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1559778

Description Tomas Hoger 2018-04-17 20:23:43 UTC

It was discovered that the Libraries component of OpenJDK failed to properly check array object type VarHandle in certain cases. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2018-04-17 20:28:47 UTC

Affected functionality - VarHandle - was only introduced in OpenJDK 9.

Comment 2 Tomas Hoger 2018-04-17 21:01:54 UTC

Public now via Oracle CPU April 2018:

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA

The issue was fixed in Oracle JDK 10.0.1.

Comment 3 Tomas Hoger 2018-04-20 20:52:50 UTC

OpenJDK 10 upstream commit:

http://hg.openjdk.java.net/jdk-updates/jdk10u/rev/a562e21b4bd2