PT-2019-3219 · Eclipse+4 · Eclipse Openj9+4
Peter Shipton
·
Published
2019-07-11
·
Updated
2020-10-08
·
CVE-2019-11775
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Eclipse OpenJ9 versions prior to 0.15
Description
The issue is related to synchronization errors when using shared resources, which can lead to a "race condition" situation. This can cause memory corruption. Additionally, there is a problem with the loop versioner failing to privatize a value pulled out of the loop, potentially resulting in issues such as reading out of array bounds. The vulnerability could also allow a local attacker to gain elevated privileges on the system by injecting code due to unused RPATHS in AIX builds.
Recommendations
For Eclipse OpenJ9 versions prior to 0.15, update to version 0.15 or later to resolve the issue.
As a temporary workaround, consider restricting access to shared resources to minimize the risk of exploitation.
Avoid using the loop versioner with conditions that read fields and are moved out of the loop until the issue is resolved.
Fix
Race Condition
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Eclipse Openj9
Ibm Aix
Red Hat
Suse