In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
Weakness
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openj9 | Eclipse | * | 0.29.0 (excluding) |
| Red Hat Enterprise Linux 7 Supplementary | RedHat | java-1.8.0-ibm-1:1.8.0.7.0-1jpp.1.el7 | * |
| Red Hat Enterprise Linux 7 Supplementary | RedHat | java-1.7.1-ibm-1:1.7.1.5.0-1jpp.1.el7 | * |
| Red Hat Enterprise Linux 8 | RedHat | java-1.8.0-ibm-1:1.8.0.7.0-1.el8_5 | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/104.html
- https://cwe.mitre.org/data/definitions/470.html
- https://cwe.mitre.org/data/definitions/69.html
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=576395
- https://github.com/eclipse-openj9/openj9/pull/13740
- https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=576395
- https://github.com/eclipse-openj9/openj9/pull/13740
- https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104
- https://security.netapp.com/advisory/ntap-20240621-0006/