CVE Vulnerabilities

CVE-2018-12549

Direct Use of Unsafe JNI

Published: Feb 11, 2019 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
9.8 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.

Weakness

When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.

Affected Software

Name Vendor Start Version End Version
Openj9 Eclipse 0.11.0 (including) 0.11.0 (including)
Red Hat Enterprise Linux 6 Supplementary RedHat java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el6_10 *
Red Hat Enterprise Linux 7 Supplementary RedHat java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el7 *
Red Hat Enterprise Linux 8 RedHat java-1.8.0-ibm-1:1.8.0.5.35-3.el8_0 *
Red Hat Satellite 5.8 RedHat java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el6_10 *

Potential Mitigations

References