CVE-2023-21967: Oracle GraalVM DOS Vulnerability

CVE-2023-21967 Overview

CVE-2023-21967 is a Denial of Service vulnerability in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via HTTPS to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of affected Java applications.

The vulnerability is particularly concerning for Java deployments that run untrusted code, such as sandboxed Java Web Start applications or Java applets that load content from the internet. Additionally, this vulnerability can be exploited through APIs in the JSSE component, including web services that supply data to these APIs.

Critical Impact

Successful exploitation enables remote attackers to cause complete denial of service of Java applications without authentication, potentially disrupting critical business services and infrastructure running on affected Java versions.

Affected Products

• Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20
• Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5, 22.3.1
• Oracle OpenJDK: Multiple versions through 8u362 and version 20
• NetApp 7-Mode Transition Tool
• NetApp Brocade SAN Navigator
• NetApp Cloud Insights Acquisition Unit
• NetApp Cloud Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• Debian Linux: 10.0, 11.0, 12.0

Discovery Timeline

• April 18, 2023 - CVE-2023-21967 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-21967

Vulnerability Analysis

This vulnerability resides in the Java Secure Socket Extension (JSSE), which provides the framework and implementation for SSL/TLS protocols in Java. The flaw allows an unauthenticated remote attacker to trigger a denial of service condition through carefully crafted HTTPS requests.

The attack requires network access to the target application and exploits weaknesses in how JSSE handles certain SSL/TLS operations. While the vulnerability is classified as difficult to exploit due to the high attack complexity required, successful exploitation results in complete availability impact—causing the affected Java application to hang or crash repeatedly.

This vulnerability specifically affects the availability of the system without compromising confidentiality or integrity. Applications that process SSL/TLS connections, particularly those accepting connections from untrusted sources, are at highest risk.

Root Cause

The root cause stems from improper handling within the JSSE component when processing specific SSL/TLS protocol operations. The vulnerability occurs in the TLS handshake or secure connection handling logic, where malformed or specially crafted input can cause the application to enter an unresponsive state or crash.

The issue affects the core cryptographic communication layer of Java, making any application that relies on JSSE for secure communications potentially vulnerable when exposed to malicious network traffic.

Attack Vector

The attack vector is network-based, specifically targeting HTTPS connections. An attacker can exploit this vulnerability remotely without requiring any authentication or user interaction. The attack flow involves:

1. The attacker identifies a Java application using an affected version of Java SE or GraalVM
2. The attacker sends specially crafted HTTPS requests to the target application
3. The malicious input triggers the vulnerability in the JSSE component
4. The affected Java process hangs or crashes, resulting in denial of service

The vulnerability can also be triggered through web services that pass attacker-controlled data to JSSE APIs, expanding the potential attack surface beyond direct HTTPS connections.

Detection Methods for CVE-2023-21967

Indicators of Compromise

• Unexpected Java process hangs or crashes when handling HTTPS connections
• Repeated JVM crashes with stack traces pointing to JSSE or SSL/TLS handling code
• Sudden spikes in failed HTTPS connection attempts in application logs
• Memory or thread exhaustion in Java applications processing SSL/TLS traffic

Detection Strategies

• Monitor Java application logs for exceptions related to SSL/TLS handshake failures or JSSE component errors
• Implement network intrusion detection rules to identify anomalous HTTPS traffic patterns targeting Java services
• Track JVM process stability metrics to detect unusual crash patterns or hangs
• Audit deployed Java versions across the environment to identify vulnerable installations

Monitoring Recommendations

• Configure alerting for Java process health checks to detect unresponsive applications
• Enable verbose SSL/TLS logging in development and staging environments to identify potential exploitation attempts
• Monitor network traffic to Java applications for unusual HTTPS request patterns
• Implement application performance monitoring (APM) to detect degradation in SSL/TLS handling performance

How to Mitigate CVE-2023-21967

Immediate Actions Required

• Update Oracle Java SE to versions newer than 8u361, 11.0.18, 17.0.6, or 20 as applicable
• Update Oracle GraalVM Enterprise Edition to versions newer than 20.3.9, 21.3.5, or 22.3.1
• Update OpenJDK installations to the latest patched versions
• Review and restrict network access to Java applications where possible

Patch Information

Oracle has released security patches addressing this vulnerability in the April 2023 Critical Patch Update. Organizations should apply the appropriate patches based on their Java version:

• Oracle JDK/JRE 8: Update to version newer than 8u361
• Oracle JDK/JRE 11: Update to version newer than 11.0.18
• Oracle JDK/JRE 17: Update to version newer than 17.0.6
• Oracle JDK/JRE 20: Update to version newer than 20
• Oracle GraalVM Enterprise Edition: Update beyond versions 20.3.9, 21.3.5, and 22.3.1

Additional vendor advisories are available from NetApp Security Advisory, Debian Security Advisory DSA-5430, and Debian Security Advisory DSA-5478.

Workarounds

• Implement network-level controls to restrict access to Java applications from untrusted networks
• Deploy web application firewalls (WAF) to filter potentially malicious HTTPS traffic before it reaches Java applications
• Consider disabling Java Web Start and Java applets if not required for business operations
• Isolate critical Java applications in segmented network zones with strict ingress filtering

# Verify installed Java version
java -version

# Example: Check for vulnerable versions in Linux environments
find /usr -name "java" -type f -exec {} -version \; 2>&1 | grep -E "1\.8\.0_361|11\.0\.18|17\.0\.6|20\."

# Update Java on Debian-based systems
sudo apt update && sudo apt upgrade openjdk-11-jdk