CVE-2025-2900: IBM Semeru Runtime DoS Vulnerability

CVE-2025-2900 Overview

CVE-2025-2900 is a buffer overflow vulnerability in IBM Semeru Runtime that affects multiple major versions of the Java runtime environment. The vulnerability exists in the native AES/CBC encryption implementation and can be exploited remotely to cause a denial of service condition through a crash triggered by the buffer overflow.

IBM Semeru Runtime is IBM's distribution of the OpenJDK runtime, widely used in enterprise Java applications. This vulnerability affects versions across four major release streams (8, 11, 17, and 21), making it a significant concern for organizations relying on IBM's Java runtime for production workloads.

Critical Impact

Remote attackers can cause application crashes by exploiting the buffer overflow in the AES/CBC encryption implementation, leading to denial of service without requiring authentication.

Affected Products

• IBM Semeru Runtime 8.0.302.0 through 8.0.442.0
• IBM Semeru Runtime 11.0.12.0 through 11.0.26.0
• IBM Semeru Runtime 17.0.0.0 through 17.0.14.0
• IBM Semeru Runtime 21.0.0.0 through 21.0.6.0

Discovery Timeline

• 2025-05-14 - CVE-2025-2900 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-2900

Vulnerability Analysis

This vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The flaw resides in the native implementation of AES encryption using Cipher Block Chaining (CBC) mode within IBM Semeru Runtime.

The defect allows an attacker to trigger a buffer overflow condition during cryptographic operations, which subsequently causes the Java Virtual Machine (JVM) to crash. Since AES/CBC is commonly used for encrypting data in transit and at rest, applications performing encryption operations are exposed to this vulnerability.

The attack can be executed remotely over the network without requiring any privileges or user interaction, making it particularly dangerous for internet-facing Java applications that process encrypted data from untrusted sources.

Root Cause

The root cause is a defect in the native AES/CBC encryption implementation within IBM Semeru Runtime. During encryption operations, the implementation fails to properly validate buffer boundaries, leading to a heap-based buffer overflow (CWE-122) and subsequent out-of-bounds write (CWE-787). When malicious or malformed input is processed through the encryption routine, memory corruption occurs, resulting in an unrecoverable crash of the JVM process.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker can send specially crafted input to an application using the vulnerable AES/CBC encryption implementation. The attack does not require authentication or user interaction.

Attack scenarios include:

• Targeting TLS/SSL connections that use AES-CBC cipher suites
• Exploiting applications that decrypt user-supplied encrypted data
• Attacking services that perform encryption operations on attacker-controlled input

The vulnerability affects availability only, as the result is a denial of service through application crash rather than information disclosure or code execution.

Detection Methods for CVE-2025-2900

Indicators of Compromise

• Unexpected JVM crashes with native memory errors in cryptographic operations
• Core dumps indicating buffer overflow in AES/CBC encryption routines
• Application log entries showing sudden termination during encryption/decryption tasks
• Repeated service restarts for Java applications handling encrypted communications

Detection Strategies

• Monitor Java applications for unexpected crashes or terminations, particularly those using AES/CBC encryption
• Implement process monitoring to detect repeated JVM restarts that may indicate exploitation attempts
• Review application logs for errors related to cryptographic operations or native code failures
• Use SentinelOne's behavioral AI to detect anomalous process termination patterns

Monitoring Recommendations

• Enable JVM crash reporting and centralize crash dump collection for analysis
• Configure alerting on Java application availability metrics to detect DoS conditions
• Monitor network traffic for unusual patterns targeting encryption endpoints
• Implement health checks for critical Java services to rapidly detect service disruption

How to Mitigate CVE-2025-2900

Immediate Actions Required

• Inventory all systems running IBM Semeru Runtime to identify vulnerable installations
• Prioritize patching for internet-facing applications and services handling untrusted input
• Apply the security update from IBM as soon as possible
• Consider temporarily restricting network access to vulnerable applications until patched

Patch Information

IBM has released security updates to address this vulnerability. Refer to the IBM Support Page for detailed patch information and download links for updated versions of IBM Semeru Runtime.

Organizations should update to the latest available version for their respective release stream (8, 11, 17, or 21) that includes the fix for this vulnerability.

Workarounds

• If patching is not immediately possible, consider switching to alternative cipher suites that do not use AES-CBC where feasible
• Implement rate limiting and input validation on endpoints that process encrypted data
• Deploy web application firewalls or reverse proxies to filter potentially malicious requests
• Consider isolating vulnerable applications in network segments with restricted access until patches can be applied

# Verify IBM Semeru Runtime version
java -version

# Check for vulnerable versions and plan upgrade
# Vulnerable ranges:
# 8.0.302.0 - 8.0.442.0
# 11.0.12.0 - 11.0.26.0
# 17.0.0.0 - 17.0.14.0
# 21.0.0.0 - 21.0.6.0