Oracle GraalVM/Java SE Hotspot Remote Code Execution

Summaryinfo

A vulnerability marked as critical has been reported in Oracle GraalVM and Java SE. This affects an unknown function of the component Hotspot. Performing a manipulation results in Remote Code Execution. This vulnerability is identified as CVE-2024-21235. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Oracle GraalVM and Java SE (the affected version is unknown). This affects an unknown code of the component Hotspot. The manipulation with an unknown input leads to a remote code execution vulnerability. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

It is possible to read the advisory at oracle.com. This vulnerability is uniquely identified as CVE-2024-21235 since 12/07/2023. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 209095 (Amazon Corretto Java 11.x < 11.0.25.9.1 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (209095) and CERT Bund (WID-SEC-2024-3189). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM VIOS
• IBM Java
• IBM AIX
• Debian Linux
• IBM WebSphere Service Registry and Repository
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM InfoSphere Information Server
• IBM DB2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• IBM WebSphere Application Server
• Ubuntu Linux
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• Gentoo Linux
• IBM Spectrum Protect
• IBM MQ
• IBM Storwize
• IBM SAN Volume Controller
• IBM Power Hardware Management Console
• IBM Rational Business Developer
• NetApp ActiveIQ Unified Manager
• IBM FlashSystem
• SUSE openSUSE
• IBM Business Automation Workflow
• IBM InfoSphere Identity Insight
• Azul Zulu
• IBM TXSeries
• Oracle Java SE
• IBM QRadar SIEM
• Hitachi Command Suite
• Hitachi Ops Center
• Hitachi Configuration Manager
• Dell NetWorker
• IBM App Connect Enterprise
• IBM Sterling Connect:Direct
• Amazon Corretto
• IBM Storage Scale
• IBM Storage Scale System
• IBM SPSS
• HCL Commerce
• IBM Rational Build Forge
• IBM Tivoli Business Service Manager
• IBM Security Verify Access
• HCL BigFix

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM
• Java SE

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion