CVE-2024-21144: Oracle JDK Concurrency DoS Vulnerability

CVE-2024-21144 Overview

CVE-2024-21144 is a denial of service vulnerability in the Concurrency component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The vulnerability allows an unauthenticated attacker with network access to cause a partial denial of service condition in affected Java deployments. This vulnerability primarily impacts client-side Java deployments that execute untrusted code, such as sandboxed Java Web Start applications or Java applets that load code from the internet.

Critical Impact

Unauthenticated attackers can exploit this concurrency flaw via network protocols to disrupt availability of Java-based applications running untrusted code.

Affected Products

• Oracle JDK 1.8.0 Update 411, 11.0.23
• Oracle JRE 1.8.0 Update 411, 11.0.23
• Oracle GraalVM Enterprise Edition 20.3.14 and 21.3.10
• NetApp OnCommand Workflow Automation

Discovery Timeline

• July 16, 2024 - CVE-2024-21144 published to NVD
• December 16, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21144

Vulnerability Analysis

This vulnerability resides in the Concurrency component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw enables remote attackers to trigger a partial denial of service condition without requiring authentication or user interaction. The attack complexity is high, meaning successful exploitation requires specific conditions or circumstances to be met.

The vulnerability specifically impacts Java deployments that rely on the Java sandbox for security when executing untrusted code from external sources. Server-side Java deployments that only execute trusted, administrator-installed code are not affected by this vulnerability. This distinction is critical for organizations assessing their exposure, as the attack surface is primarily limited to client-side Java applications processing untrusted content.

Root Cause

The root cause of CVE-2024-21144 lies in improper handling within the Concurrency component of Oracle Java SE. While Oracle has not disclosed specific technical details about the underlying flaw, the vulnerability classification indicates an issue in how concurrent operations are managed that can be triggered by specially crafted untrusted code executing within the Java sandbox environment.

Attack Vector

The attack vector for CVE-2024-21144 is network-based, allowing remote exploitation through multiple protocols. An attacker can exploit this vulnerability by delivering malicious code to a Java client application that processes untrusted content. The attack requires no authentication and no user interaction beyond running the vulnerable application with untrusted code.

The exploitation scenario typically involves:

1. An attacker crafting malicious Java code targeting the concurrency flaw
2. Delivery of this code to a victim's Java client application (e.g., via a malicious web page hosting a Java applet)
3. The victim's Java runtime executing the untrusted code within the sandbox
4. The malicious code triggering the concurrency issue, resulting in partial service disruption

Due to the high attack complexity and the declining use of Java applets and Web Start applications in modern environments, practical exploitation opportunities are limited. No public exploit code is currently available for this vulnerability.

Detection Methods for CVE-2024-21144

Indicators of Compromise

• Unusual Java process resource consumption or performance degradation
• Java application crashes or hangs related to concurrency operations
• Unexpected network connections from Java client applications to untrusted sources
• Log entries indicating sandbox violations or concurrency-related exceptions

Detection Strategies

• Monitor Java application logs for concurrency-related errors or exceptions
• Deploy application performance monitoring to detect partial denial of service conditions
• Implement network-based detection for Java Web Start or applet traffic patterns
• Use SentinelOne's behavioral AI to identify anomalous Java process behavior indicative of exploitation attempts

Monitoring Recommendations

• Audit Java Runtime Environment versions across all endpoints to identify vulnerable installations
• Enable verbose logging for Java applications processing untrusted content
• Monitor for Java processes exhibiting unexpected resource utilization patterns
• Track network connections from Java applications to identify potential attack delivery vectors

How to Mitigate CVE-2024-21144

Immediate Actions Required

• Update Oracle Java SE to versions newer than 8u411 and 11.0.23
• Update Oracle GraalVM Enterprise Edition to versions newer than 20.3.14 and 21.3.10
• Disable Java applets and Java Web Start applications where not required
• Restrict Java applications from loading untrusted code from the internet

Patch Information

Oracle has addressed this vulnerability in the July 2024 Critical Patch Update. Organizations should review the Oracle Security Alert for July 2024 for detailed patch information and download locations.

For NetApp OnCommand Workflow Automation deployments, refer to the NetApp Security Advisory NTAP-20240719-0007 for specific remediation guidance.

Workarounds

• Configure Java security policies to prevent execution of untrusted applets and Web Start applications
• Implement network-level controls to block Java Web Start and applet content from untrusted sources
• Consider disabling legacy Java plugin support in web browsers if not required for business operations
• Deploy application whitelisting to prevent unauthorized Java code execution

# Disable Java plugin in browser deployments
# Add to deployment.properties file
deployment.webjava.enabled=FALSE

# Restrict Java security policy for untrusted code
# Add to java.security configuration
deployment.security.level=VERY_HIGH