CVE-2022-21365: Oracle GraalVM ImageIO DOS Vulnerability

CVE-2022-21365 Overview

CVE-2022-21365 is a denial of service vulnerability in the ImageIO component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (partial DoS) against affected Java deployments.

The vulnerability is particularly concerning for Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet while relying on the Java sandbox for security. Additionally, the vulnerability can be exploited through APIs in the ImageIO component, such as through web services that supply data to these APIs.

Critical Impact

Unauthenticated remote attackers can cause service degradation through network-accessible ImageIO API exploitation, affecting availability of Java-based applications and services.

Affected Products

• Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1
• Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0
• Oracle OpenJDK: Multiple versions including 7, 8, 11, and 17 series
• Debian Linux: 9.0, 10.0, 11.0
• NetApp Products: Active IQ Unified Manager, Cloud Insights Acquisition Unit, Cloud Secure Agent, E-Series SANtricity products, OnCommand Insight, OnCommand Workflow Automation, SnapManager, SolidFire, and others

Discovery Timeline

• January 19, 2022 - CVE-2022-21365 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-21365

Vulnerability Analysis

This vulnerability resides in the ImageIO component of Oracle Java SE and GraalVM Enterprise Edition. The ImageIO API provides a pluggable architecture for working with images, supporting various formats through image readers and writers. The flaw allows attackers to cause resource exhaustion or processing issues when the ImageIO component handles specially crafted input.

The vulnerability can be triggered remotely without any user interaction or authentication. When exploited, the attack results in degraded service availability rather than complete system unavailability, making it a partial denial of service condition. This affects both client-side Java applications (applets and Web Start) and server-side deployments where ImageIO APIs process untrusted image data.

Root Cause

The root cause stems from insufficient input validation or resource management within the ImageIO component when processing image data. The component fails to properly handle certain malformed or malicious input, leading to resource consumption that impacts service availability. Oracle has not disclosed specific technical details about the exact flaw, classifying this as NVD-CWE-noinfo.

Attack Vector

The attack vector is network-based and can be executed through multiple protocols. An attacker can exploit this vulnerability by:

1. Delivering malicious image data to a sandboxed Java applet or Web Start application running on the victim's system
2. Sending crafted image data to server-side applications that use ImageIO APIs to process user-supplied content
3. Targeting web services that accept and process image data through ImageIO components

The attack requires no privileges and no user interaction, making it straightforward for attackers to exploit. The vulnerability specifically impacts the availability of the affected system, with no impact on confidentiality or integrity.

Detection Methods for CVE-2022-21365

Indicators of Compromise

• Unusual resource consumption (CPU, memory) in Java processes, particularly those handling image processing
• Increased latency or timeouts in Java-based web services that process images
• Application logs showing errors or exceptions related to ImageIO operations
• Repeated requests containing image data to vulnerable endpoints

Detection Strategies

• Monitor Java application performance metrics for anomalous resource usage patterns during image processing operations
• Implement application-level logging for ImageIO API calls and analyze for unusual patterns or malformed input
• Deploy network intrusion detection rules to identify potential exploitation attempts targeting Java image processing endpoints
• Use SentinelOne's behavioral AI to detect Java process anomalies indicative of denial of service attacks

Monitoring Recommendations

• Enable detailed logging for Java applications processing untrusted image data
• Configure alerts for Java process resource exhaustion thresholds
• Monitor web application firewall logs for suspicious image upload patterns
• Track application availability metrics for services utilizing ImageIO components

How to Mitigate CVE-2022-21365

Immediate Actions Required

• Update Oracle Java SE to versions newer than 7u321, 8u311, 11.0.13, or 17.0.1 respectively
• Update Oracle GraalVM Enterprise Edition beyond versions 20.3.4 and 21.3.0
• Apply operating system vendor patches for bundled Java packages (Debian, etc.)
• Review and restrict network access to Java-based image processing services where possible

Patch Information

Oracle addressed this vulnerability in the January 2022 Critical Patch Update. Organizations should apply the appropriate patches based on their Java distribution:

• Oracle JDK/JRE: Update to the patched versions available from Oracle
• OpenJDK: Apply updates from your distribution vendor or the OpenJDK project
• Debian Linux: Apply security updates per DSA-5057 and DSA-5058
• NetApp Products: Refer to the NetApp Security Advisory for product-specific guidance
• Gentoo Linux: Apply updates per GLSA 202209-05

Workarounds

• Disable or restrict access to Java Web Start and applet functionality where not required
• Implement input validation and sanitization for image data before processing with ImageIO APIs
• Deploy web application firewalls to filter potentially malicious image uploads
• Consider sandboxing or isolating Java applications that must process untrusted image data

# Check current Java version to determine if patching is required
java -version

# For systems using alternatives, list available Java versions
update-alternatives --list java

# Example: Updating Java on Debian-based systems
apt-get update && apt-get upgrade openjdk-11-jdk