CVE-2022-39419: Oracle Java VM Information Disclosure Flaw

CVE-2022-39419 Overview

CVE-2022-39419 affects the Java VM component of Oracle Database Server, specifically versions 19c and 21c. The flaw permits a low-privileged attacker with the CREATE PROCEDURE privilege to access a subset of Java VM accessible data over Oracle Net. Exploitation requires network access but no user interaction. Oracle addressed the issue in the October 2022 Critical Patch Update.

Critical Impact
Authenticated attackers with CREATE PROCEDURE privilege can obtain unauthorized read access to Java VM data inside the Oracle Database, exposing confidential information stored or processed by the Java VM.

Affected Products

Oracle Database Server, Java VM component, version 19c
Oracle Database Server, Java VM component, version 21c
Deployments exposing Oracle Net to users granted the CREATE PROCEDURE privilege

Discovery Timeline

2022-10-18 - CVE-2022-39419 published to the National Vulnerability Database (NVD)
2022-10-18 - Oracle released a fix in the Oracle Critical Patch Update - October 2022
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2022-39419

Vulnerability Analysis

The vulnerability resides in the Java VM component embedded inside the Oracle Database Server. The Java VM executes Java stored procedures and PL/SQL-callable code inside the database kernel. A low-privileged database user holding the CREATE PROCEDURE privilege can interact with the Java VM through Oracle Net and read data that should remain isolated. The issue is classified as an information disclosure flaw with confidentiality-only impact. NVD lists the weakness as NVD-CWE-noinfo because Oracle did not publish detailed root cause information. The current EPSS score is 0.209% at the 43.128 percentile, indicating limited near-term exploitation likelihood.

Root Cause

Oracle did not disclose the precise defect. Based on the advisory, the Java VM fails to enforce sufficient access controls when a procedure created by a low-privileged user requests data through Oracle Net. The result is an authorization gap that exposes a subset of Java VM accessible data.

Attack Vector

The attacker authenticates to the database with an account that has the CREATE PROCEDURE privilege. The attacker then creates a Java stored procedure and invokes it over Oracle Net to read Java VM data that the role should not be permitted to access. No user interaction is required, and the attack complexity is low.

No public proof-of-concept code is available for this issue. Refer to the Oracle Critical Patch Update - October 2022 for vendor-supplied details.

Detection Methods for CVE-2022-39419

Indicators of Compromise

Unexpected CREATE PROCEDURE or CREATE JAVA activity by accounts that do not normally author Java stored procedures
Java stored procedures invoking classes that touch internal Java VM resources or system packages
Sessions originating from Oracle Net clients that execute Java methods immediately after creating a procedure

Detection Strategies

Audit DBA_OBJECTS and DBA_JAVA_CLASSES for new Java-based objects created by low-privileged schemas
Enable Oracle Unified Auditing for CREATE PROCEDURE, CREATE JAVA, and execution of Java stored procedures
Correlate Oracle Net session metadata with procedure creation events to identify reconnaissance against the Java VM

Monitoring Recommendations

Forward Oracle audit trails to a centralized analytics platform for behavioral baselining of privileged DDL activity
Alert on grants or role changes that add CREATE PROCEDURE to non-developer accounts
Review database listener logs for unusual client IPs invoking Java stored procedures over Oracle Net

How to Mitigate CVE-2022-39419

Immediate Actions Required

Apply the October 2022 Critical Patch Update to Oracle Database 19c and 21c instances
Inventory accounts holding CREATE PROCEDURE and revoke the privilege where it is not required
Restrict Oracle Net exposure to trusted application hosts using valid node checking or network ACLs

Patch Information

Oracle delivered the fix as part of the Oracle Critical Patch Update - October 2022. Administrators should install the corresponding Database Release Update or Patch Set Update for 19c and 21c and validate that the Java VM component is upgraded. Confirm the patch level with SELECT * FROM DBA_REGISTRY_HISTORY; after application.

Workarounds

Revoke the CREATE PROCEDURE system privilege from accounts that do not need Java or PL/SQL development capabilities
Disable or remove the Java VM component on databases that do not require server-side Java execution
Limit Oracle Net access through sqlnet.oraTCP.VALIDNODE_CHECKING and firewall rules to reduce the attacker population

bash

# Example: revoke procedure creation privilege from a low-trust user
sqlplus / as sysdba
REVOKE CREATE PROCEDURE FROM app_user;
REVOKE CREATE ANY PROCEDURE FROM app_user;