CVE-2021-35586: Oracle GraalVM ImageIO DOS Vulnerability

CVE-2021-35586 Overview

CVE-2021-35586 is a denial of service vulnerability affecting the ImageIO component within Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access to cause a partial denial of service condition in affected Java deployments. The flaw is particularly concerning for environments running sandboxed Java Web Start applications or Java applets that process untrusted code from external sources such as the internet.

The vulnerability can be exploited through multiple network protocols and affects a wide range of Java versions across both Oracle's standard Java SE distribution and the high-performance GraalVM Enterprise Edition. Organizations relying on web services that supply data to ImageIO APIs are also at risk of exploitation.

Critical Impact

Unauthenticated attackers can remotely trigger partial denial of service conditions in Java applications processing images through the ImageIO component, potentially disrupting critical business services.

Affected Products

• Oracle OpenJDK 7u311, 8u301, 11.0.12, and 17
• Oracle GraalVM Enterprise Edition 20.3.3 and 21.2.0
• NetApp Active IQ Unified Manager (VMware vSphere and Windows)
• NetApp E-Series SANtricity OS Controller, Storage Manager, and Web Services
• NetApp HCI Management Node, OnCommand Insight, OnCommand Workflow Automation
• NetApp SANtricity Unified Manager, SnapManager (Oracle and SAP), SolidFire
• Fedora 33, 34, and 35
• Debian Linux 9.0, 10.0, and 11.0

Discovery Timeline

• October 20, 2021 - CVE-2021-35586 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-35586

Vulnerability Analysis

This vulnerability resides in the ImageIO component of Java SE, which is responsible for reading and writing images in various formats. The ImageIO framework provides a pluggable architecture for image codecs and is widely used in Java applications for image processing tasks.

The flaw allows attackers to trigger resource consumption issues when the ImageIO component processes specially crafted image data. Since the vulnerability requires no authentication or user interaction, attackers can remotely target any Java application that exposes ImageIO functionality through network-accessible services.

The vulnerability primarily impacts availability rather than confidentiality or integrity. Successful exploitation results in partial degradation of service rather than complete system compromise, making it suitable for disruption attacks against Java-based services.

Root Cause

The root cause lies in improper handling of image data within the ImageIO component. When processing certain types of image input, the component fails to properly validate or limit resource consumption, allowing malicious actors to cause excessive resource usage. This leads to degraded performance and partial denial of service conditions affecting the availability of the Java runtime environment.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability through several methods:

1. Java Web Start/Applet Attacks: Targeting client-side Java deployments that run sandboxed applications loading untrusted code from the internet
2. Web Service Exploitation: Sending malicious image data to web services that utilize the ImageIO APIs for image processing
3. API-based Attacks: Directly invoking vulnerable ImageIO methods through any network-accessible interface that accepts image input

The exploitation is considered easily achievable due to the low attack complexity and the lack of authentication requirements. An attacker simply needs network access to a vulnerable Java application that processes image data through ImageIO.

Detection Methods for CVE-2021-35586

Indicators of Compromise

• Unusual spikes in CPU or memory utilization on Java application servers processing image data
• Increased latency or timeout errors in image processing services
• Abnormal patterns in network traffic containing image data payloads to ImageIO-enabled endpoints
• Application log entries indicating resource exhaustion or out-of-memory conditions in ImageIO operations

Detection Strategies

• Monitor Java application performance metrics for anomalous resource consumption during image processing operations
• Implement request rate limiting and payload size restrictions on endpoints accepting image uploads
• Deploy network intrusion detection rules to identify potential exploitation attempts targeting Java image processing services
• Review application logs for repeated failures or exceptions originating from javax.imageio package classes

Monitoring Recommendations

• Configure alerting for sustained high resource utilization patterns on Java application servers
• Establish baseline metrics for normal ImageIO operation to facilitate anomaly detection
• Implement centralized logging for all Java applications to correlate potential exploitation attempts across the environment
• Monitor for unusual patterns of image upload activity or requests to image processing endpoints

How to Mitigate CVE-2021-35586

Immediate Actions Required

• Inventory all Java deployments to identify systems running vulnerable versions (Java SE 7u311, 8u301, 11.0.12, 17; GraalVM 20.3.3, 21.2.0)
• Prioritize patching for internet-facing Java applications and services that process image data
• Review and restrict network access to Java-based image processing services where possible
• Implement input validation and size limits on image uploads as a defense-in-depth measure

Patch Information

Oracle has addressed this vulnerability in the October 2021 Critical Patch Update (CPU). Administrators should upgrade to the latest patched versions of Java SE and GraalVM Enterprise Edition as documented in the Oracle Security Alert CPU October 2021.

Additional security advisories and patched packages are available from downstream distributors:

• Debian Security Advisory DSA-5000 and DSA-5012
• Debian LTS Security Announcement
• Fedora Package Announcements
• NetApp Security Advisory
• Gentoo GLSA Advisory

Workarounds

• Restrict network access to ImageIO-dependent services using firewall rules or network segmentation
• Disable or remove Java Web Start and applet functionality if not required in your environment
• Implement application-level input validation to reject potentially malicious image data before it reaches ImageIO
• Deploy web application firewalls (WAF) with rules to filter suspicious image upload requests

# Example: Verify installed Java version for vulnerability assessment
java -version

# Check for vulnerable versions and plan upgrade path
# Vulnerable: 7u311, 8u301, 11.0.12, 17 (initial release)
# Action: Upgrade to latest patched version from Oracle CPU October 2021