Bug 2060725 (CVE-2022-0853) - CVE-2022-0853 jboss-client: memory leakage in remote client transaction
Summary: CVE-2022-0853 jboss-client: memory leakage in remote client transaction
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-0853
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2060727
TreeView+ depends on / blocked
 
Reported: 2022-03-04 06:14 UTC by Sandipan Roy
Modified: 2022-08-17 06:17 UTC (History)
61 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the jboss-client. A memory leak on the JBoss client-side occurs when using UserTransaction repeatedly, leading to an information leakage vulnerability.
Clone Of:
Environment:
Last Closed: 2022-06-06 19:49:40 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:4918 0 None None None 2022-06-06 15:52:28 UTC
Red Hat Product Errata RHSA-2022:4919 0 None None None 2022-06-06 15:58:48 UTC
Red Hat Product Errata RHSA-2022:4922 0 None None None 2022-06-06 15:12:13 UTC

Description Sandipan Roy 2022-03-04 06:14:53 UTC
A memory leak on the jboss client side, when using UserTransaction repeatedly.

Such as:

   private void testTransaction() throws Exception {

     for(int i=1; i< 500000; i++) {
       System.out.println("Starting process " + i);

       // get the UserTransaction and EJB Proxy
       Context ctx = getInitialContext(host, port, username, password);
       UserTransaction tx = getUserTransaction(ctx);
       ControllerRemote cr = (ControllerRemote)
ctx.lookup("Controller/Controller" +
"!com.test.usertransaction.ControllerRemote");

       try {
         tx.begin();
       }
       catch(Exception ex1) {
         ex1.printStackTrace();
       }
       //System.out.println("user transaction started");

       cr.mainCall();

       try {
         tx.commit();;
       }
       catch(Exception ex1) {
         ex1.printStackTrace();
         throw ex1;
       }
       //System.out.println("commited user transaction");

       if(ctx != null)
         ctx.close();
     }
   }


Transaction is executed by a remote client on a EJB deployed in EAP 7.3. Transaction is iterated for 50000 times.  At the end of the iterations memory leakage is observed. 32% memory is occupied by  org.wildfly.transaction.client.provider.remoting.TransactionClientChannel.

Comment 6 errata-xmlrpc 2022-06-06 15:12:09 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922

Comment 7 errata-xmlrpc 2022-06-06 15:52:23 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918

Comment 8 errata-xmlrpc 2022-06-06 15:58:44 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919

Comment 9 Product Security DevOps Team 2022-06-06 19:49:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0853


Note You need to log in before you can comment on or make changes to this bug.