CVE-2022-21305: Integer Overflow
A flaw was found in the way the Hotspot component of OpenJDK handled array indexes on 64-bit x86 platform. A large index could trigger a displacement overflow in LIRGenerator::emitarrayaddress, possibly leading to an access at an invalid array position.
Other sources
An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
— IBM
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-21305?
CVE-2022-21305 has been classified as a high severity vulnerability.
How do I fix CVE-2022-21305?
To fix CVE-2022-21305, update your OpenJDK to the latest patched version.
What are the affected versions for CVE-2022-21305?
CVE-2022-21305 affects multiple versions of OpenJDK including versions 8, 11, and 17 up to certain updates.
What type of vulnerability is CVE-2022-21305?
CVE-2022-21305 is a displacement overflow vulnerability involving array index handling.
Is CVE-2022-21305 being actively exploited?
There is no current evidence that CVE-2022-21305 is being actively exploited, but it is recommended to apply mitigating measures.