CVE-2022-21341: Oracle GraalVM Serialization DoS Flaw

CVE-2022-21341 Overview

CVE-2022-21341 is a Denial of Service vulnerability in the Serialization component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java deployments, resulting in a partial denial of service condition.

The vulnerability is particularly concerning for environments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet. Additionally, web services that supply data to the affected Serialization APIs are also vulnerable to exploitation.

Critical Impact
Unauthenticated remote attackers can cause partial denial of service in Java applications and services that process serialized data from untrusted sources.

Affected Products

Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1
Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0
Oracle OpenJDK: Multiple versions through 17.0.1
NetApp products including Active IQ Unified Manager, OnCommand Insight, and SolidFire
Debian Linux 9.0, 10.0, and 11.0

Discovery Timeline

2022-01-19 - CVE-2022-21341 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21341

Vulnerability Analysis

This vulnerability resides in the Serialization component of Oracle Java SE and GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker to trigger a partial denial of service condition through network-accessible protocols. The attack requires no user interaction and can be executed remotely against any exposed Java application that processes serialized data.

The vulnerability primarily impacts availability rather than confidentiality or integrity. Successful exploitation results in degraded service availability, potentially affecting business-critical Java applications and services. The ease of exploitation combined with the network attack vector makes this vulnerability a concern for internet-facing Java deployments.

Organizations running Java Web Start applications, Java applets, or web services that accept serialized data from untrusted sources are at heightened risk. The vulnerability can be triggered through legitimate APIs in the Serialization component when supplied with malicious data.

Root Cause

The root cause of CVE-2022-21341 lies in improper handling within the Java Serialization component. The vulnerability occurs when the serialization mechanism processes specially crafted input, leading to resource consumption that causes service degradation. The flaw exists in how the component handles certain serialized object structures, allowing attackers to consume excessive resources and cause partial denial of service conditions.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a Java application or web service that accepts serialized data
Crafting malicious serialized input designed to trigger the vulnerability
Sending the malicious payload to the target application via network protocols
Causing partial denial of service as the application processes the malicious data

The vulnerability is particularly dangerous in environments where Java applications are exposed to the internet or process data from untrusted sources. Java Web Start applications and applets running sandboxed code from the internet are primary targets, as well as backend web services that deserialize client-supplied data.

Detection Methods for CVE-2022-21341

Indicators of Compromise

Unusual resource consumption patterns in Java applications, particularly during serialization operations
Increased latency or partial service disruptions in Java-based web services
Application logs showing repeated serialization failures or exceptions
Network traffic patterns indicating attempts to send malformed serialized data to Java endpoints

Detection Strategies

Monitor Java application performance metrics for abnormal CPU or memory usage during deserialization
Implement logging and alerting on serialization exceptions in application code
Use network intrusion detection systems to identify suspicious payloads targeting Java serialization endpoints
Deploy application-level monitoring to detect service degradation patterns consistent with DoS attacks

Monitoring Recommendations

Enable detailed logging for Java serialization operations in production environments
Configure alerting thresholds for application response times and resource utilization
Monitor for repeated failed deserialization attempts from the same source
Implement SentinelOne's real-time behavioral analysis to detect exploitation attempts

How to Mitigate CVE-2022-21341

Immediate Actions Required

Update Oracle Java SE to version 7u331, 8u321, 11.0.14, or 17.0.2 or later
Update Oracle GraalVM Enterprise Edition to version 20.3.5, 21.3.1, or later
Apply vendor patches for NetApp and Debian products as available
Restrict network access to Java applications and services where possible
Review and limit exposure of serialization endpoints to untrusted networks

Patch Information

Oracle has released security patches addressing this vulnerability in the January 2022 Critical Patch Update. Organizations should obtain patches from the Oracle Security Alert January 2022. For Debian systems, security advisories DSA-5057 and DSA-5058 provide updated packages. NetApp customers should refer to the NetApp Security Advisory for product-specific guidance.

Workarounds

Implement serialization filtering using ObjectInputFilter to restrict deserialized classes
Disable Java Web Start and Java applets in browser environments where not required
Deploy network-level filtering to block suspicious serialized data payloads
Consider isolating Java applications that must process untrusted serialized data in sandboxed environments

bash

# Example: Configure serialization filter in Java application
# Add to JVM startup options to restrict deserialized classes
java -Djdk.serialFilter="!*" -jar application.jar

# Or allow only specific packages
java -Djdk.serialFilter="com.mycompany.*;java.base/*;!*" -jar application.jar