CVE-2022-45146: Bouncycastle FIPS Java Use-After-Free Flaw

CVE-2022-45146 Overview

CVE-2022-45146 is a Use After Free vulnerability discovered in the FIPS Java API of Bouncy Castle (BC-FJA) affecting versions before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where temporary cryptographic keys used by the module can be zeroed out while still actively in use. This premature key destruction can result in application errors or potential information loss during cryptographic operations.

It is important to note that FIPS compliant users operating within the certified configuration are unaffected, as the FIPS certification is only valid for Java 7, 8, and 11. Organizations using the Bouncy Castle FIPS module with Java 13 or later outside the certified configuration are at risk.

Critical Impact

Temporary cryptographic keys may be prematurely destroyed during garbage collection, potentially exposing sensitive information or causing cryptographic operation failures in applications using BC-FJA with Java 13+.

Affected Products

• Bouncy Castle FIPS Java API versions before 1.0.2.4
• Oracle JDK versions 13 and later (when used with vulnerable BC-FJA versions)
• Applications using BC-FJA outside FIPS certified configurations (Java 7, 8, 11)

Discovery Timeline

• 2022-11-21 - CVE-2022-45146 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-45146

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), occurring within the Bouncy Castle FIPS Java API's key management subsystem. The root issue stems from how the BC-FJA module manages the lifecycle of temporary cryptographic keys in conjunction with changes introduced to the JVM garbage collector starting with Java 13.

When cryptographic operations are performed, the BC-FJA module creates temporary key objects that are designed to be securely zeroed out after use to prevent key material from persisting in memory. However, the enhanced garbage collector behavior in Java 13+ can trigger premature cleanup of these key objects while they are still being referenced and used by ongoing cryptographic operations. This race condition between the garbage collector and active cryptographic processes creates a Use After Free scenario where the module attempts to use key material that has already been zeroed.

The local attack vector requires an attacker to have access to the affected system or application. The vulnerability can result in high confidentiality impact as cryptographic key material may be compromised or operations may fail in ways that expose sensitive data.

Root Cause

The vulnerability originates from the BC-FJA module's key lifecycle management not properly accounting for the aggressive garbage collection strategies introduced in Java 13 and subsequent versions. The module's internal key destruction mechanism relies on finalizers or cleanup handlers that can be invoked by the garbage collector before the cryptographic operations using those keys have completed. This timing issue creates a window where key objects are freed while still being actively referenced, leading to Use After Free conditions.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have access to the system running the affected application. Exploitation scenarios include:

1. An attacker with local access could potentially trigger garbage collection events under specific conditions to cause key material corruption
2. Applications processing high volumes of cryptographic operations may inadvertently experience information disclosure when keys are prematurely zeroed
3. Error conditions resulting from the vulnerability could be leveraged to gain insight into cryptographic operations or cause denial of service

The vulnerability requires low privileges to exploit and does not require user interaction. While the scope is unchanged (confined to the vulnerable component), successful exploitation can result in high confidentiality impact through potential exposure of cryptographic key material.

For detailed technical information about this vulnerability, refer to the GitHub CVE-2022-45146 Details page maintained by the Bouncy Castle project.

Detection Methods for CVE-2022-45146

Indicators of Compromise

• Unexpected cryptographic operation failures or exceptions in applications using BC-FJA with Java 13 or later
• Application logs showing NullPointerException or memory-related errors during cryptographic key operations
• Intermittent encryption/decryption failures that correlate with garbage collection events
• Error messages indicating invalid or corrupted key material during BC-FJA operations

Detection Strategies

• Audit deployed applications for BC-FJA library versions prior to 1.0.2.4 using software composition analysis (SCA) tools
• Monitor Java runtime versions in production environments to identify systems running Java 13+ with vulnerable BC-FJA versions
• Review Maven or Gradle dependency files for org.bouncycastle:bc-fips artifacts with vulnerable version numbers
• Implement application performance monitoring to detect anomalous cryptographic operation failure rates

Monitoring Recommendations

• Enable verbose garbage collection logging (-Xlog:gc*) in Java applications using BC-FJA to correlate GC events with cryptographic errors
• Configure application monitoring to alert on cryptographic operation exceptions originating from Bouncy Castle packages
• Establish baseline metrics for cryptographic operation success rates and alert on deviations
• Monitor system logs for memory-related errors in applications utilizing FIPS cryptographic modules

How to Mitigate CVE-2022-45146

Immediate Actions Required

• Upgrade Bouncy Castle FIPS Java API to version 1.0.2.4 or later immediately
• If upgrade is not immediately possible, restrict affected applications to Java 7, 8, or 11 (FIPS certified versions)
• Conduct a comprehensive inventory of all applications using BC-FJA to prioritize remediation efforts
• Review and test cryptographic operations after upgrade to ensure proper functionality

Patch Information

Bouncy Castle has addressed this vulnerability in BC-FJA version 1.0.2.4. The patched version properly handles key lifecycle management to prevent premature destruction of key material by the garbage collector in Java 13 and later versions.

Organizations should update their BC-FJA dependency to the latest available version. The updated library can be obtained from the Maven Repository Bouncy Castle FIPS page or directly from the Bouncy Castle Latest Releases page.

Workarounds

• Downgrade Java runtime to version 11 or earlier (within FIPS certified configurations) as a temporary measure
• If using Java 13+, implement additional synchronization around cryptographic operations to reduce race condition likelihood
• Consider using non-FIPS Bouncy Castle libraries if FIPS compliance is not required while awaiting upgrade
• Implement application-level error handling to gracefully manage cryptographic failures and prevent information disclosure

# Configuration example - Update Maven dependency to patched version
# In pom.xml, update the bc-fips dependency:
# <dependency>
#     <groupId>org.bouncycastle</groupId>
#     <artifactId>bc-fips</artifactId>
#     <version>1.0.2.4</version>
# </dependency>

# Verify installed BC-FJA version in your project
mvn dependency:tree | grep bc-fips

# Force dependency update
mvn versions:use-latest-releases -Dincludes=org.bouncycastle:bc-fips