CVE-2024-21068: Oracle GraalVM RCE Vulnerability

CVE-2024-21068 Overview

CVE-2024-21068 is a vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products, specifically affecting the Hotspot component. This vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise affected systems. While difficult to exploit, successful attacks can result in unauthorized update, insert, or delete access to some accessible data within the affected Oracle Java products.

This vulnerability can be exploited through APIs in the Hotspot component, including through web services that supply data to these APIs. Additionally, it affects Java deployments in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet, relying on the Java sandbox for security.

Critical Impact

Successful exploitation allows unauthorized data modification in Oracle Java SE and GraalVM environments, potentially affecting data integrity in enterprise applications and sandboxed Java deployments.

Affected Products

• Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22
• Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22
• Oracle GraalVM Enterprise Edition: 21.3.9
• Oracle JDK: 1.8.0 update401, 11.0.22, 17.0.10, 21.0.2, 22.0.1
• Oracle JRE: 1.8.0 update401, 11.0.22, 17.0.10, 21.0.2, 22
• NetApp Active IQ Unified Manager (VMware vSphere and Windows)
• NetApp Data Infrastructure Insights Acquisition Unit
• NetApp Data Infrastructure Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• Debian Linux 10.0

Discovery Timeline

• April 16, 2024 - CVE-2024-21068 published to NVD
• December 6, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21068

Vulnerability Analysis

The vulnerability resides in the Hotspot component of Oracle Java SE and GraalVM products. Hotspot is the Java Virtual Machine (JVM) implementation that provides the runtime environment for Java applications, handling just-in-time (JIT) compilation and memory management. The flaw allows network-based exploitation through multiple protocols, though it requires specific conditions to be met, making exploitation complex.

The impact is limited to data integrity, with no confidentiality or availability impacts reported. This means attackers cannot read sensitive information or cause service disruptions through this vulnerability alone, but they can potentially modify data in unauthorized ways within the scope of the affected application.

Root Cause

The specific technical root cause has not been publicly disclosed by Oracle beyond identifying the Hotspot component as the affected area. The vulnerability affects the JVM's internal processing mechanisms and can be triggered through APIs that accept external input. This type of vulnerability in the Hotspot component typically relates to improper handling of bytecode compilation, memory management, or runtime optimizations.

Attack Vector

The attack is network-based and can be executed without authentication or user interaction. However, the high attack complexity indicates that specific conditions must be met for successful exploitation:

1. The attacker must have network access to the target system running vulnerable Java applications
2. The attack can be conducted through web services or APIs that feed data to the Hotspot component
3. For client-side attacks, the victim must be running sandboxed Java Web Start applications or Java applets that load untrusted code
4. The attacker needs to craft specific inputs that trigger the vulnerability in the JIT compilation or runtime optimization process

The vulnerability demonstrates integrity impacts only, allowing unauthorized modification of accessible data without affecting confidentiality or availability.

Detection Methods for CVE-2024-21068

Indicators of Compromise

• Unexpected data modifications in Java-based applications without corresponding audit trails
• Anomalous network traffic patterns targeting Java RMI, JNDI, or other Java-related network services
• Unusual JVM behavior or unexpected bytecode execution patterns in application logs

Detection Strategies

• Implement Java version inventory scanning across all systems to identify vulnerable installations of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition
• Monitor network traffic for suspicious patterns targeting Java-based services, particularly through RMI, HTTP, and other protocols used by Java applications
• Enable JVM diagnostic logging to capture detailed information about JIT compilation and runtime behavior anomalies
• Deploy application-level monitoring to detect unauthorized data modification attempts in Java applications

Monitoring Recommendations

• Configure SIEM alerts for unusual Java process behavior or unexpected network connections from JVM processes
• Implement file integrity monitoring on Java application data stores to detect unauthorized modifications
• Monitor for attempts to load untrusted code in sandboxed Java environments, particularly Java Web Start and applet deployments
• Track API access patterns to Java-based web services for anomalous request patterns

How to Mitigate CVE-2024-21068

Immediate Actions Required

• Inventory all systems running Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to identify vulnerable installations
• Prioritize patching for systems running Java Web Start applications or Java applets that execute untrusted code
• Apply network segmentation to limit exposure of vulnerable Java services to untrusted networks
• Review and restrict API access to Java-based web services where feasible

Patch Information

Oracle has released security updates addressing this vulnerability in the April 2024 Critical Patch Update. Organizations should apply the latest patches from Oracle to remediate this vulnerability. The following vendors have also released advisories and patches:

• Oracle Security Alert - Official Oracle Critical Patch Update for April 2024
• NetApp Security Advisory - Advisory for affected NetApp products
• Debian LTS Advisory - Security update for Debian systems

Upgrade to the following minimum versions:

• Oracle Java SE: 8u411, 11.0.23, 17.0.11, 21.0.3, or 22.0.1
• Oracle GraalVM for JDK: 17.0.11, 21.0.3, or 22.0.1
• Oracle GraalVM Enterprise Edition: 21.3.10 or later

Workarounds

• Disable Java Web Start and Java applet functionality in browsers if not required for business operations
• Implement strict network access controls to limit exposure of Java-based services to trusted networks only
• Use application-level firewalls to filter and validate input to Java-based web services and APIs
• Consider deploying runtime application self-protection (RASP) solutions to monitor JVM behavior

# Verify current Java version on Linux/macOS systems
java -version

# Check all installed Java versions on the system
update-alternatives --list java

# For Windows systems, check Java installations
# Run in PowerShell
Get-ChildItem "HKLM:\SOFTWARE\JavaSoft\Java Development Kit" -ErrorAction SilentlyContinue
Get-ChildItem "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment" -ErrorAction SilentlyContinue

# Disable Java Web Start (remove file associations)
# Linux: Remove javaws from alternatives
sudo update-alternatives --remove-all javaws 2>/dev/null || echo "javaws not configured"