CVE-2022-21341: Oracle GraalVM Serialization DoS Flaw

CVE-2022-21341 Overview

CVE-2022-21341 is a Denial of Service vulnerability in the Serialization component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java deployments, resulting in a partial denial of service condition.

The vulnerability is particularly concerning for environments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet. Additionally, web services that supply data to the affected Serialization APIs are also vulnerable to exploitation.

Critical Impact

Unauthenticated remote attackers can cause partial denial of service in Java applications and services that process serialized data from untrusted sources.

Affected Products

• Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1
• Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0
• Oracle OpenJDK: Multiple versions through 17.0.1
• NetApp products including Active IQ Unified Manager, OnCommand Insight, and SolidFire
• Debian Linux 9.0, 10.0, and 11.0

Discovery Timeline

• 2022-01-19 - CVE-2022-21341 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21341

Vulnerability Analysis

This vulnerability resides in the Serialization component of Oracle Java SE and GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker to trigger a partial denial of service condition through network-accessible protocols. The attack requires no user interaction and can be executed remotely against any exposed Java application that processes serialized data.

The vulnerability primarily impacts availability rather than confidentiality or integrity. Successful exploitation results in degraded service availability, potentially affecting business-critical Java applications and services. The ease of exploitation combined with the network attack vector makes this vulnerability a concern for internet-facing Java deployments.

Organizations running Java Web Start applications, Java applets, or web services that accept serialized data from untrusted sources are at heightened risk. The vulnerability can be triggered through legitimate APIs in the Serialization component when supplied with malicious data.

Root Cause

The root cause of CVE-2022-21341 lies in improper handling within the Java Serialization component. The vulnerability occurs when the serialization mechanism processes specially crafted input, leading to resource consumption that causes service degradation. The flaw exists in how the component handles certain serialized object structures, allowing attackers to consume excessive resources and cause partial denial of service conditions.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a Java application or web service that accepts serialized data
2. Crafting malicious serialized input designed to trigger the vulnerability
3. Sending the malicious payload to the target application via network protocols
4. Causing partial denial of service as the application processes the malicious data

The vulnerability is particularly dangerous in environments where Java applications are exposed to the internet or process data from untrusted sources. Java Web Start applications and applets running sandboxed code from the internet are primary targets, as well as backend web services that deserialize client-supplied data.

Detection Methods for CVE-2022-21341

Indicators of Compromise

• Unusual resource consumption patterns in Java applications, particularly during serialization operations
• Increased latency or partial service disruptions in Java-based web services
• Application logs showing repeated serialization failures or exceptions
• Network traffic patterns indicating attempts to send malformed serialized data to Java endpoints

Detection Strategies

• Monitor Java application performance metrics for abnormal CPU or memory usage during deserialization
• Implement logging and alerting on serialization exceptions in application code
• Use network intrusion detection systems to identify suspicious payloads targeting Java serialization endpoints
• Deploy application-level monitoring to detect service degradation patterns consistent with DoS attacks

Monitoring Recommendations

• Enable detailed logging for Java serialization operations in production environments
• Configure alerting thresholds for application response times and resource utilization
• Monitor for repeated failed deserialization attempts from the same source
• Implement SentinelOne's real-time behavioral analysis to detect exploitation attempts

How to Mitigate CVE-2022-21341

Immediate Actions Required

• Update Oracle Java SE to version 7u331, 8u321, 11.0.14, or 17.0.2 or later
• Update Oracle GraalVM Enterprise Edition to version 20.3.5, 21.3.1, or later
• Apply vendor patches for NetApp and Debian products as available
• Restrict network access to Java applications and services where possible
• Review and limit exposure of serialization endpoints to untrusted networks

Patch Information

Oracle has released security patches addressing this vulnerability in the January 2022 Critical Patch Update. Organizations should obtain patches from the Oracle Security Alert January 2022. For Debian systems, security advisories DSA-5057 and DSA-5058 provide updated packages. NetApp customers should refer to the NetApp Security Advisory for product-specific guidance.

Workarounds

• Implement serialization filtering using ObjectInputFilter to restrict deserialized classes
• Disable Java Web Start and Java applets in browser environments where not required
• Deploy network-level filtering to block suspicious serialized data payloads
• Consider isolating Java applications that must process untrusted serialized data in sandboxed environments

# Example: Configure serialization filter in Java application
# Add to JVM startup options to restrict deserialized classes
java -Djdk.serialFilter="!*" -jar application.jar

# Or allow only specific packages
java -Djdk.serialFilter="com.mycompany.*;java.base/*;!*" -jar application.jar