CVE-2024-20921: Medium severity Oracle GraalVM vulnerability
A flaw was found in the loop optimizations performed by the Hotspot component of OpenJDK when generating range check predicates. An untrusted Java application or applet could use this flaw to corrupt JVM memory and cause it to crash or, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
Other sources
An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality impact.
— IBM
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20921?
CVE-2024-20921 is classified as a high-severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-20921?
To fix CVE-2024-20921, upgrade to the latest versions of OpenJDK or affected IBM Cognos Controller as specified in the vendor's advisory.
Which versions of OpenJDK are affected by CVE-2024-20921?
CVE-2024-20921 affects OpenJDK versions 8, 11, 17, and 21 prior to the specified remedied versions.
What are the potential consequences of exploiting CVE-2024-20921?
Exploitation of CVE-2024-20921 can lead to corruption of JVM memory, application crashes, or the execution of arbitrary code.
Is IBM Cognos Controller vulnerable to CVE-2024-20921?
Yes, IBM Cognos Controller versions 11.0.0 to 11.0.1 are vulnerable to CVE-2024-20921 and should be upgraded.