CVE-2022-21540: Use After Free
A flaw was found in the way the Hotspot component of OpenJDK generated class code. An untrusted Java application or applet could potentially use this flaw to bypass Java sandbox restrictions.
Other sources
An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
— IBM
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21540?
CVE-2022-21540 is classified as a critical vulnerability due to its potential to bypass Java sandbox restrictions.
How do I fix CVE-2022-21540?
To fix CVE-2022-21540, upgrade to the latest patched version of OpenJDK or Java SE as specified in the respective vendor advisories.
What systems are affected by CVE-2022-21540?
CVE-2022-21540 affects multiple versions of OpenJDK, Oracle JDK, and GraalVM, particularly those prior to their latest security updates.
Can CVE-2022-21540 be exploited remotely?
Yes, CVE-2022-21540 can potentially be exploited remotely by an unauthenticated attacker targeting untrusted Java applications.
Is there a workaround for CVE-2022-21540?
Currently, the best mitigation for CVE-2022-21540 is to apply the security patches provided by the vendors and avoid running untrusted Java applications.