Bug 2108543 (CVE-2022-21541) - CVE-2022-21541 OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866)
Summary: CVE-2022-21541 OpenJDK: improper restriction of MethodHandle.invokeBasic() (H...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-21541
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2106502 2106503 2106504 2106505 2106506 2106507 2106508 2106509 2106510 2106511 2106512 2106513 2106514 2106515 2106516 2106517 2106518 2106519 2106520 2106521 2106522 2106523 2106524 2121471
Blocks: 2106494
TreeView+ depends on / blocked
 
Reported: 2022-07-19 09:36 UTC by Mauro Matteo Cascella
Modified: 2024-03-15 15:14 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-08-30 16:55:55 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:5690 0 None None None 2022-07-21 21:02:30 UTC
Red Hat Product Errata RHBA-2022:5705 0 None None None 2022-07-25 22:03:06 UTC
Red Hat Product Errata RHBA-2022:5706 0 None None None 2022-07-25 22:00:56 UTC
Red Hat Product Errata RHBA-2022:5707 0 None None None 2022-07-25 21:57:33 UTC
Red Hat Product Errata RHBA-2022:5708 0 None None None 2022-07-25 22:05:11 UTC
Red Hat Product Errata RHBA-2022:5710 0 None None None 2022-07-26 10:15:34 UTC
Red Hat Product Errata RHBA-2022:5712 0 None None None 2022-07-26 12:16:36 UTC
Red Hat Product Errata RHBA-2022:5722 0 None None None 2022-07-26 15:58:42 UTC
Red Hat Product Errata RHBA-2022:5724 0 None None None 2022-07-26 16:26:42 UTC
Red Hat Product Errata RHBA-2022:5728 0 None None None 2022-07-26 21:37:31 UTC
Red Hat Product Errata RHBA-2022:5750 0 None None None 2022-07-28 12:40:20 UTC
Red Hat Product Errata RHBA-2022:5751 0 None None None 2022-07-28 12:38:17 UTC
Red Hat Product Errata RHBA-2022:5752 0 None None None 2022-07-28 14:13:07 UTC
Red Hat Product Errata RHBA-2022:5763 0 None None None 2022-07-28 19:43:59 UTC
Red Hat Product Errata RHBA-2022:5782 0 None None None 2022-08-01 11:50:27 UTC
Red Hat Product Errata RHBA-2022:5783 0 None None None 2022-08-01 11:53:19 UTC
Red Hat Product Errata RHBA-2022:5784 0 None None None 2022-08-01 11:55:07 UTC
Red Hat Product Errata RHBA-2022:5873 0 None None None 2022-08-03 08:58:50 UTC
Red Hat Product Errata RHBA-2022:5882 0 None None None 2022-08-03 10:35:44 UTC
Red Hat Product Errata RHBA-2022:5885 0 None None None 2022-08-03 15:36:47 UTC
Red Hat Product Errata RHBA-2022:5886 0 None None None 2022-08-03 15:38:06 UTC
Red Hat Product Errata RHBA-2022:6025 0 None None None 2022-08-10 03:14:37 UTC
Red Hat Product Errata RHBA-2022:6031 0 None None None 2022-08-10 07:22:26 UTC
Red Hat Product Errata RHBA-2022:6045 0 None None None 2022-08-10 14:41:25 UTC
Red Hat Product Errata RHBA-2022:6049 0 None None None 2022-08-10 17:01:14 UTC
Red Hat Product Errata RHBA-2022:6050 0 None None None 2022-08-10 17:47:21 UTC
Red Hat Product Errata RHBA-2022:6059 0 None None None 2022-08-15 08:39:57 UTC
Red Hat Product Errata RHBA-2022:6067 0 None None None 2022-08-15 10:45:07 UTC
Red Hat Product Errata RHBA-2022:6076 0 None None None 2022-08-16 10:39:13 UTC
Red Hat Product Errata RHBA-2022:6077 0 None None None 2022-08-16 10:35:01 UTC
Red Hat Product Errata RHBA-2022:6112 0 None None None 2022-08-18 11:44:23 UTC
Red Hat Product Errata RHBA-2022:6140 0 None None None 2022-08-23 18:08:49 UTC
Red Hat Product Errata RHBA-2022:6186 0 None None None 2022-08-25 08:14:07 UTC
Red Hat Product Errata RHSA-2022:5681 0 None None None 2022-07-21 15:26:27 UTC
Red Hat Product Errata RHSA-2022:5683 0 None None None 2022-07-21 15:23:50 UTC
Red Hat Product Errata RHSA-2022:5684 0 None None None 2022-07-21 15:00:42 UTC
Red Hat Product Errata RHSA-2022:5685 0 None None None 2022-07-21 14:10:00 UTC
Red Hat Product Errata RHSA-2022:5687 0 None None None 2022-07-21 16:48:29 UTC
Red Hat Product Errata RHSA-2022:5695 0 None None None 2022-07-25 14:52:22 UTC
Red Hat Product Errata RHSA-2022:5696 0 None None None 2022-07-25 15:42:04 UTC
Red Hat Product Errata RHSA-2022:5697 0 None None None 2022-07-25 15:40:30 UTC
Red Hat Product Errata RHSA-2022:5698 0 None None None 2022-07-25 18:17:36 UTC
Red Hat Product Errata RHSA-2022:5700 0 None None None 2022-07-25 15:52:58 UTC
Red Hat Product Errata RHSA-2022:5701 0 None None None 2022-07-25 15:30:04 UTC
Red Hat Product Errata RHSA-2022:5709 0 None None None 2022-07-25 23:15:34 UTC
Red Hat Product Errata RHSA-2022:5726 0 None None None 2022-07-26 18:20:58 UTC
Red Hat Product Errata RHSA-2022:5736 0 None None None 2022-07-27 13:19:54 UTC
Red Hat Product Errata RHSA-2022:5753 0 None None None 2022-07-28 15:32:43 UTC
Red Hat Product Errata RHSA-2022:5754 0 None None None 2022-07-28 15:33:27 UTC
Red Hat Product Errata RHSA-2022:5755 0 None None None 2022-07-28 15:40:29 UTC
Red Hat Product Errata RHSA-2022:5756 0 None None None 2022-07-28 15:41:14 UTC
Red Hat Product Errata RHSA-2022:5757 0 None None None 2022-07-28 15:46:28 UTC
Red Hat Product Errata RHSA-2022:5758 0 None None None 2022-07-28 15:47:15 UTC

Description Mauro Matteo Cascella 2022-07-19 09:36:57 UTC 
It was discovered that the Hotspot component of OpenJDK did not properly restrict access to the invokeBasic() method of the MethodHandle class. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Comment 1 Mauro Matteo Cascella 2022-07-19 23:42:17 UTC 
Public now via Oracle CPU July 2022:

https://www.oracle.com/security-alerts/cpujul2022.html#AppendixJAVA

Fixed in Oracle Java SE 7u351, 8u341, 11.0.16, 17.0.4, 18.0.2.

Release notes:
https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#R170_351
https://www.oracle.com/java/technologies/javase/8u341-relnotes.html
https://www.oracle.com/java/technologies/javase/11-0-16-relnotes.html
https://www.oracle.com/java/technologies/javase/17-0-4-relnotes.html
https://www.oracle.com/java/technologies/javase/18-0-2-relnotes.html
Comment 8 errata-xmlrpc 2022-07-21 14:09:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:5685 https://access.redhat.com/errata/RHSA-2022:5685
Comment 9 errata-xmlrpc 2022-07-21 15:00:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:5684 https://access.redhat.com/errata/RHSA-2022:5684
Comment 10 errata-xmlrpc 2022-07-21 15:23:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5683 https://access.redhat.com/errata/RHSA-2022:5683
Comment 11 errata-xmlrpc 2022-07-21 15:26:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5681 https://access.redhat.com/errata/RHSA-2022:5681
Comment 12 errata-xmlrpc 2022-07-21 16:48:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:5687 https://access.redhat.com/errata/RHSA-2022:5687
Comment 13 errata-xmlrpc 2022-07-25 14:52:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5695 https://access.redhat.com/errata/RHSA-2022:5695
Comment 14 errata-xmlrpc 2022-07-25 15:30:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:5701 https://access.redhat.com/errata/RHSA-2022:5701
Comment 15 errata-xmlrpc 2022-07-25 15:40:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5697 https://access.redhat.com/errata/RHSA-2022:5697
Comment 16 errata-xmlrpc 2022-07-25 15:42:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5696 https://access.redhat.com/errata/RHSA-2022:5696
Comment 17 errata-xmlrpc 2022-07-25 15:52:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:5700 https://access.redhat.com/errata/RHSA-2022:5700
Comment 18 errata-xmlrpc 2022-07-25 18:17:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:5698 https://access.redhat.com/errata/RHSA-2022:5698
Comment 19 errata-xmlrpc 2022-07-25 23:15:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5709 https://access.redhat.com/errata/RHSA-2022:5709
Comment 20 errata-xmlrpc 2022-07-26 18:20:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5726 https://access.redhat.com/errata/RHSA-2022:5726
Comment 21 errata-xmlrpc 2022-07-27 13:19:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5736 https://access.redhat.com/errata/RHSA-2022:5736
Comment 22 errata-xmlrpc 2022-07-28 15:32:41 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u342

Via RHSA-2022:5753 https://access.redhat.com/errata/RHSA-2022:5753
Comment 23 errata-xmlrpc 2022-07-28 15:33:24 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u342

Via RHSA-2022:5754 https://access.redhat.com/errata/RHSA-2022:5754
Comment 24 errata-xmlrpc 2022-07-28 15:40:26 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 11.0.16

Via RHSA-2022:5755 https://access.redhat.com/errata/RHSA-2022:5755
Comment 25 errata-xmlrpc 2022-07-28 15:41:09 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 11.0.16

Via RHSA-2022:5756 https://access.redhat.com/errata/RHSA-2022:5756
Comment 26 errata-xmlrpc 2022-07-28 15:46:25 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.4

Via RHSA-2022:5757 https://access.redhat.com/errata/RHSA-2022:5757
Comment 27 errata-xmlrpc 2022-07-28 15:47:13 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.4

Via RHSA-2022:5758 https://access.redhat.com/errata/RHSA-2022:5758
Comment 28 Mauro Matteo Cascella 2022-07-29 17:05:43 UTC 
OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/860464e46105b98ccf21e98abe2dc6e80155887c

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/132745902a4601dc64b2c8ca112ca30292feccb4

OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/f14e35d20e1a4d0f507f05838844152f2242c6d3
Comment 31 Product Security DevOps Team 2022-08-30 16:55:52 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-21541
Note You need to log in before you can comment on or make changes to this bug.