CVE-2023-5676 - Vulnerability Details - OpenCVE

In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Eclipse	Openj9
Redhat	Enterprise Linux Rhel Extras

Configuration 1 [-]

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7 Supplementary
java-1.8.0-ibm-1:1.8.0.8.15-1jpp.1.el7	cpe:/a:redhat:rhel_extras:7	RHSA-2024:0879	2024-02-20T00:00:00Z
Red Hat Enterprise Linux 8
java-1.8.0-ibm-1:1.8.0.8.15-1.el8_9	cpe:/a:redhat:enterprise_linux:8::supplementary	RHSA-2024:0866	2024-02-19T00:00:00Z

References

Link	Providers
https://github.com/eclipse-openj9/openj9/pull/18085
https://gitlab.eclipse.org/security/cve-assignement/-/issues/13
https://nvd.nist.gov/vuln/detail/CVE-2023-5676
https://www.cve.org/CVERecord?id=CVE-2023-5676
https://www.ibm.com/support/pages/apar/IJ49075

History

No history.

MITRE

Status: PUBLISHED

Assigner: eclipse

Published: 2023-11-15T14:02:01.422Z

Updated: 2024-08-29T14:50:03.835Z

Reserved: 2023-10-20T04:59:29.125Z

Link: CVE-2023-5676

Vulnrichment

Updated: 2024-08-02T08:07:32.636Z

NVD

Status : Modified

Published: 2023-11-15T14:15:07.683

Modified: 2024-11-21T08:42:15.140

Link: CVE-2023-5676

Redhat

Severity : Moderate

Publid Date: 2023-11-15T00:00:00Z

Links: CVE-2023-5676 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5676", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2023-10-20T04:59:29.125Z", "datePublished": "2023-11-15T14:02:01.422Z", "dateUpdated": "2024-08-29T14:50:03.835Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenJ9", "vendor": "Eclipse Foundation", "versions": [{"lessThan": "0.41.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.<br>"}], "value": "In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-364", "description": "CWE-364: Signal Handler Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2023-11-15T14:02:01.422Z"}, "references": [{"url": "https://github.com/eclipse-openj9/openj9/pull/18085"}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13"}], "source": {"discovery": "UNKNOWN"}, "title": "Eclipse OpenJ9 possible infinite busy hang", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.636Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/eclipse-openj9/openj9/pull/18085", "tags": ["x_transferred"]}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-29T14:41:09.024509Z", "id": "CVE-2023-5676", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:50:03.835Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/eclipse-openj9/openj9/pull/18085", "tags": ["x_transferred"]}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:07:32.636Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-29T14:41:09.024509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T14:49:59.299Z"}}], "cna": {"title": "Eclipse OpenJ9 possible infinite busy hang", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "OpenJ9", "versions": [{"status": "affected", "version": "0", "lessThan": "0.41.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse-openj9/openj9/pull/18085"}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.\n", "supportingMedia": [{"type": "text/html", "value": "In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-364", "description": "CWE-364: Signal Handler Race Condition"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2023-11-15T14:02:01.422Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5676", "state": "PUBLISHED", "dateUpdated": "2024-08-29T14:50:03.835Z", "dateReserved": "2023-10-20T04:59:29.125Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2023-11-15T14:02:01.422Z", "assignerShortName": "eclipse"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0B1C1DC-3572-4BD0-9AE4-32F62B970F6A", "versionEndExcluding": "0.41.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.\n"}, {"lang": "es", "value": "En Eclipse OpenJ9 anterior a la versi\u00f3n 0.41.0, la JVM puede verse forzada a un bloqueo de ocupaci\u00f3n infinita en un bloqueo de giro o una falla de segmentaci\u00f3n si se recibe una se\u00f1al de apagado (SIGTERM, SIGINT o SIGHUP) antes de que la JVM haya terminado de inicializarse."}], "id": "CVE-2023-5676", "lastModified": "2024-11-21T08:42:15.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 3.6, "source": "emo@eclipse.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-15T14:15:07.683", "references": [{"source": "emo@eclipse.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/eclipse-openj9/openj9/pull/18085"}, {"source": "emo@eclipse.org", "tags": ["Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/eclipse-openj9/openj9/pull/18085"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/13"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-364"}], "source": "emo@eclipse.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}