CVE-2022-21340: Oracle GraalVM DOS Vulnerability

CVE-2022-21340 Overview

CVE-2022-21340 is a denial-of-service vulnerability in the Libraries component of Oracle Java SE and Oracle GraalVM Enterprise Edition. Affected versions include Oracle Java SE 7u321, 8u311, 11.0.13, and 17.0.1, plus Oracle GraalVM Enterprise Edition 20.3.4 and 21.3.0. An unauthenticated attacker with network access can exploit the flaw across multiple protocols to cause a partial denial of service. The issue impacts sandboxed Java Web Start applications, sandboxed Java applets that load untrusted code, and APIs exposed through web services that feed data into the Libraries component.

Critical Impact
Remote unauthenticated attackers can trigger a partial denial of service against Java SE and GraalVM Enterprise applications, including downstream NetApp products that embed the affected Java runtimes.

Affected Products

Oracle Java SE 7u321, 8u311, 11.0.13, 17.0.1 (JDK and JRE)
Oracle GraalVM Enterprise Edition 20.3.4 and 21.3.0
NetApp products including Active IQ Unified Manager, OnCommand Insight, OnCommand Workflow Automation, SnapManager, SolidFire, HCI Management Node, and E-Series SANtricity components; Debian Linux 9, 10, 11; Oracle OpenJDK

Discovery Timeline

2022-01-19 - CVE-2022-21340 published to NVD as part of Oracle Critical Patch Update January 2022
2022-01-19 - Oracle releases security patches via the January 2022 Critical Patch Update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21340

Vulnerability Analysis

The vulnerability resides in the Libraries component shared by Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw is remotely exploitable without authentication and requires no user interaction. Successful exploitation produces an availability impact only, with no confidentiality or integrity consequences according to the published CVSS vector.

The scope of exposure is broad because the affected Libraries code is invoked by sandboxed Java Web Start applications, sandboxed Java applets handling untrusted code, and any server-side API that forwards attacker-influenced data into the vulnerable functions. NetApp embeds these runtimes in storage management products, extending the exposure to enterprise infrastructure. The EPSS probability for this CVE is approximately 6.4 percent, indicating measurable but not widespread exploitation activity. Oracle did not assign a specific CWE class, listing the entry as NVD-CWE-noinfo.

Root Cause

Oracle has not published detailed root-cause information for CVE-2022-21340. The Oracle Critical Patch Update advisory categorizes the defect under the Libraries subcomponent and confirms that the flaw allows resource consumption sufficient to produce a partial denial of service. Public references from Debian, Gentoo, and NetApp reiterate the Oracle advisory without disclosing further internals.

Attack Vector

Attacks reach the vulnerable code through multiple network protocols. Two primary delivery paths exist. First, a client that loads a malicious sandboxed Java Web Start application or applet from the internet executes attacker-controlled code that exercises the vulnerable Libraries API. Second, a server-side application that exposes a web service or other endpoint can be made to call the vulnerable API by supplying crafted input data. In both paths the attacker requires no credentials and no privileges on the target.

No verified public proof-of-concept exploit is currently available. See the Oracle Critical Patch Update January 2022 for vendor technical details.

Detection Methods for CVE-2022-21340

Indicators of Compromise

Repeated abnormal termination, hang conditions, or thread starvation in Java processes (java, javaw) running affected JDK or JRE builds
Sudden CPU or memory exhaustion in NetApp management applications, GraalVM-hosted services, or Java-based web service endpoints
Inbound requests to Java web services carrying malformed payloads that precede service unavailability

Detection Strategies

Inventory all hosts running Oracle JDK or JRE 7u321, 8u311, 11.0.13, 17.0.1, or GraalVM Enterprise 20.3.4 and 21.3.0 using software asset management and EDR telemetry.
Correlate process crash and restart events for Java runtimes with preceding network connections to public-facing application endpoints.
Monitor application logs for unhandled exceptions, thread pool exhaustion, or out-of-memory errors originating in standard library code paths.

Monitoring Recommendations

Alert on availability degradation of NetApp Active IQ Unified Manager, OnCommand Insight, OnCommand Workflow Automation, and SolidFire management services.
Track outbound applet and Java Web Start launches from end-user systems and block connections to untrusted hosts at the proxy.
Forward Java garbage collection and JVM crash logs to a centralized SIEM for anomaly analysis.

How to Mitigate CVE-2022-21340

Immediate Actions Required

Apply the Oracle Critical Patch Update from January 2022 to all affected Java SE and GraalVM Enterprise Edition installations.
Update NetApp products to fixed releases as listed in NetApp Security Advisory NTAP-20220121-0007.
On Debian systems, install the openjdk-11 and openjdk-17 updates documented in Debian Security Advisory DSA-5057 and Debian Security Advisory DSA-5058.

Patch Information

Oracle addressed CVE-2022-21340 in the Oracle Critical Patch Update January 2022. Patched releases are Oracle Java SE 7u331, 8u321, 11.0.14, and 17.0.2, plus GraalVM Enterprise Edition 20.3.5 and 21.3.1. Distribution-level fixes are available through the Debian LTS Announcement and Gentoo GLSA 202209-05.

Workarounds

Disable Java Web Start and applet execution in browsers and on user endpoints where business requirements permit.
Restrict network access to Java-based web services so only trusted clients can submit data to APIs that traverse the Libraries component.
Place affected NetApp management interfaces behind authenticated VPN access until patches are deployed.

bash

# Verify installed Java version and confirm patched build
java -version
# Expected patched output examples:
#   java version "1.8.0_321"
#   java version "11.0.14"
#   java version "17.0.2"

# On Debian-based systems, apply security updates
sudo apt-get update
sudo apt-get install --only-upgrade openjdk-11-jre openjdk-17-jre