Eclipse OpenJ9 up to 0.20 System.arraycopy Return Value type confusion

Summaryinfo

A vulnerability identified as critical has been detected in Eclipse OpenJ9 up to 0.20. The impacted element is an unknown function of the file System.arraycopy. Performing a manipulation as part of Return Value results in type confusion. This vulnerability is reported as CVE-2019-17639. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Eclipse OpenJ9 up to 0.20. This affects some unknown functionality of the file System.arraycopy. The manipulation as part of a Return Value leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

The weakness was disclosed 07/15/2020 (Website). The advisory is shared at bugs.eclipse.org. This vulnerability is uniquely identified as CVE-2019-17639 since 10/16/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 208630 (CentOS 6 : java-1.7.1-ibm (RHSA-2020:3387)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.21 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208630). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Eclipse

Name

• OpenJ9

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion