CVE-2024-21145: Oracle GraalVM Auth Bypass Vulnerability

CVE-2024-21145 Overview

CVE-2024-21145 is a vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Oracle disclosed the issue as part of the July 2024 Critical Patch Update. An unauthenticated attacker with network access through multiple protocols can compromise affected Java runtimes, though successful exploitation requires high attack complexity. Successful attacks can result in unauthorized update, insert, or delete access to a subset of accessible data, as well as unauthorized read access to a subset of accessible data. The flaw also applies to sandboxed Java Web Start applications and sandboxed Java applets that load untrusted code and rely on the Java sandbox for security.

Critical Impact
Unauthenticated network attackers can read and modify a subset of data processed by Oracle Java SE and GraalVM, with additional risk to sandboxed Java workloads that load untrusted code.

Affected Products

Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1
Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1
Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10; NetApp BlueXP, Cloud Insights Storage Workload Security Agent, OnCommand Insight, OnCommand Workflow Automation

Discovery Timeline

2024-07-16 - Oracle publishes the July 2024 Critical Patch Update including CVE-2024-21145
2024-07-16 - CVE-2024-21145 published to NVD
2024-07-19 - NetApp publishes downstream advisory NTAP-20240719-0008
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-21145

Vulnerability Analysis

The vulnerability resides in the 2D component, which handles graphics rendering, image processing, and font operations across Java SE and GraalVM distributions. The flaw is categorized under [CWE-284] Improper Access Control. An attacker reaches the vulnerable code paths by submitting crafted input to APIs that consume 2D data structures, including web services that forward attacker-controlled image or font data to backend Java workloads.

The issue affects both server-side Java deployments and client-side sandboxed code. In server scenarios, exposure depends on whether application code passes untrusted bytes to 2D APIs. In client scenarios, a Java Web Start application or applet that loads untrusted code can leverage the flaw to escape sandbox constraints affecting confidentiality and integrity. Availability is not impacted.

Root Cause

The underlying defect is an access control weakness in the 2D component that lets untrusted code interact with privileged data structures or resources it should not reach. Oracle has not published the precise function-level details. The vulnerability requires high attack complexity, indicating that exploitation depends on specific runtime conditions or input shapes that are not directly controlled by the attacker.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. The most realistic delivery paths are web services that forward attacker-supplied image, font, or graphics data into Java 2D APIs, and sandboxed Java clients that fetch untrusted code from the internet. No public proof-of-concept or in-the-wild exploitation has been reported, and the EPSS probability is 0.45%.

No verified exploit code is available. Refer to the Oracle Security Alert July 2024 for component-level guidance.

Detection Methods for CVE-2024-21145

Indicators of Compromise

Unexpected Java process invocations of java.awt, sun.java2d, or sun.font classes when processing externally sourced images or fonts
Anomalous outbound connections initiated by JVM processes that handle untrusted graphics input
Java runtime crashes or stack traces referencing 2D rendering pipelines on hosts exposed to network input

Detection Strategies

Inventory all hosts running affected Oracle JDK, JRE, and GraalVM versions using software asset management or endpoint telemetry
Identify web services and APIs that accept image, font, or 2D graphics data and route them to Java backends, then prioritize those for patching
Correlate JVM version metadata with the affected versions listed in the NetApp Security Advisory for embedded product exposure

Monitoring Recommendations

Alert on JVM processes spawning unexpected child processes or accessing files outside their normal working directories
Log and review network-facing endpoints that pass user-supplied media into Java 2D APIs
Track patch state for NetApp BlueXP, OnCommand Insight, OnCommand Workflow Automation, and Cloud Insights Storage Workload Security Agent against vendor guidance

How to Mitigate CVE-2024-21145

Immediate Actions Required

Apply the July 2024 Oracle Critical Patch Update to all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations
Upgrade NetApp products listed in NTAP-20240719-0008 to fixed releases identified by NetApp
Restrict network exposure of services that accept untrusted image, font, or 2D graphics input to Java workloads

Patch Information

Oracle released fixes in the July 2024 Critical Patch Update. Administrators should upgrade Oracle Java SE to versions newer than 8u411, 11.0.23, 17.0.11, 21.0.3, and 22.0.1, and upgrade GraalVM for JDK and GraalVM Enterprise Edition to the corresponding fixed releases. Patch details are documented in the Oracle Security Alert July 2024. NetApp customers should follow remediation steps in the NetApp Security Advisory.

Workarounds

Avoid loading untrusted code in Java Web Start applications and applets that depend on the Java sandbox for isolation
Place input validation and content filtering in front of services that pass user-supplied media into Java 2D APIs
Where patching is delayed, segment affected Java hosts away from untrusted networks and limit inbound protocols

bash

# Verify installed Java version against the affected list
java -version

# Example: upgrade an Oracle JDK installation on Linux after downloading the patched release
sudo tar -xzf jdk-21.0.4_linux-x64_bin.tar.gz -C /usr/lib/jvm/
sudo update-alternatives --install /usr/bin/java java /usr/lib/jvm/jdk-21.0.4/bin/java 1
sudo update-alternatives --config java