CVE-2022-21349: Oracle GraalVM DOS Vulnerability

CVE-2022-21349 Overview

CVE-2022-21349 is a medium-severity vulnerability in the 2D component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw affects Oracle Java SE versions 7u321 and 8u311, and Oracle GraalVM Enterprise Edition versions 20.3.4 and 21.3.0. An unauthenticated attacker with network access can exploit the issue using multiple protocols to trigger a partial denial of service against the Java runtime. The vulnerability primarily impacts Java deployments that load untrusted code in sandboxed Java Web Start applications or applets, and it can also be reached through APIs that accept attacker-supplied data, such as web services.

Critical Impact
Successful exploitation allows a remote, unauthenticated attacker to cause a partial denial of service in Oracle Java SE and Oracle GraalVM Enterprise Edition runtimes processing untrusted 2D input.

Affected Products

Oracle Java SE: 7u321, 8u311
Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0
Oracle OpenJDK 7 and 8 (multiple updates), NetApp products (SnapManager, OnCommand Insight, OnCommand Workflow Automation, SolidFire, E-Series SANtricity, HCI Management Node, Cloud Insights, 7-Mode Transition Tool), and Debian Linux 9

Discovery Timeline

2022-01-19 - CVE-2022-21349 published to NVD following the Oracle Critical Patch Update
2022-01-19 - Oracle releases January 2022 Critical Patch Update addressing the issue
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21349

Vulnerability Analysis

The vulnerability resides in the 2D graphics component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The 2D component handles rendering of images, fonts, and geometric primitives, and processes various binary inputs that may originate from untrusted sources. Malformed input handled by 2D APIs causes the Java runtime to enter a state that degrades availability. The impact is limited to availability, with no effect on confidentiality or integrity, classifying this as a partial denial of service. NVD assigns [NVD-CWE-noinfo] for the weakness category, reflecting that Oracle did not disclose the underlying technical defect.

Root Cause

Oracle has not publicly published the underlying defect for this issue. Based on the advisory, the root cause lies in how the 2D subsystem handles specific inputs that trigger an unrecoverable or resource-intensive code path. Because the vulnerability impacts only availability, the defect is consistent with patterns such as algorithmic complexity, resource exhaustion, or unchecked input that drives the runtime into a degraded processing state.

Attack Vector

The attack vector is network-based with low complexity and no authentication required. Two practical exploitation paths exist. First, an attacker can deliver a malicious payload to a victim running a sandboxed Java Web Start application or applet that loads untrusted code from the internet. Second, an attacker can submit crafted data to APIs in the 2D component, for example through a web service that forwards user-supplied content to the Java backend. No user privileges and no user interaction are required for the API path.

No public proof-of-concept exploit has been published for this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.061%, indicating a low probability of exploitation activity in the wild.

Detection Methods for CVE-2022-21349

Indicators of Compromise

Repeated Java process crashes, hangs, or unresponsive threads in services that parse images, fonts, or 2D content from untrusted sources
Spikes in CPU or memory consumption in JVM processes correlated with inbound web service requests carrying graphics payloads
Application logs showing java.awt, sun.java2d, or 2D pipeline exceptions immediately preceding service degradation

Detection Strategies

Inventory all hosts running Oracle JDK/JRE 7u321, 8u311, or GraalVM Enterprise 20.3.4/21.3.0 and flag them as vulnerable until patched
Correlate JVM crash logs and hs_err_pid files with upstream HTTP requests to identify suspicious 2D inputs reaching the runtime
Use vulnerability scanners with NVD feed integration to identify affected NetApp, Debian, and OpenJDK packages across the environment

Monitoring Recommendations

Monitor availability metrics and restart counts for Java services exposed to internet-sourced content
Alert on anomalous request patterns targeting endpoints that handle image uploads, font rendering, or PDF/graphics conversion
Track Java runtime versions through configuration management to detect drift from patched baselines

How to Mitigate CVE-2022-21349

Immediate Actions Required

Apply the Oracle January 2022 Critical Patch Update to all affected Oracle Java SE and GraalVM Enterprise Edition installations
Update NetApp products to versions referenced in the NetApp Security Advisory
For Debian systems, apply updates from the Debian LTS Announcement
Restrict network access to Java services that accept untrusted graphics or font data until patches are deployed

Patch Information

Oracle released the fix in the January 2022 Critical Patch Update. Detailed advisory and patch matrix are available in the Oracle January 2022 Security Alert. Gentoo users should reference Gentoo GLSA 202209-05. Upgrade Oracle Java SE to versions later than 7u321 and 8u311, and Oracle GraalVM Enterprise Edition beyond 20.3.4 and 21.3.0.

Workarounds

Disable Java Web Start and browser applet execution on endpoints that do not require them
Validate and constrain input sizes for any API that forwards image, font, or 2D content to a Java backend
Place rate limits and resource ceilings (CPU/memory cgroups, container limits) on Java services exposed to untrusted input to contain partial DoS impact

bash

# Verify installed Java version against affected baselines
java -version

# Example: Debian package update workflow
sudo apt-get update
sudo apt-get install --only-upgrade openjdk-8-jre openjdk-8-jdk

# Disable Java Web Start where not required (Linux example)
sudo update-alternatives --remove javaws /usr/lib/jvm/java-8-oracle/bin/javaws