Permissions, Privileges, and Access Controls in OpenJ9 - CVE-2024-3933

Vulnerability identifier: #VU91984

CSH Severity: Low

CVSS v4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-3933

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability occurs when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. A local user can exploit the vulnerability to read and write to addresses beyond the end of the array range.

OpenJ9
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Enterprise Storage
IBM i
Legacy Module
openSUSE Leap
Engineering Test Management
Tivoli Network Manager IP Edition
IBM Engineering Requirements Management DOORS Next
Tivoli Monitoring for Virtual Environments Base
CICS Transaction Gateway for Multiplatforms
DB2 Query Management Facility
Tivoli Network Configuration Manager IP Edition
IBM Semeru Runtimes
Storage Protect Backup-Archive Client
Storage Protect Server
Storage Protect Operations Center
Jazz Reporting Service
IBM Cognos Command Center
IBM Qradar SIEM
IBM Tivoli Netcool Impact
IBM Cloud Transformation Advisor
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling Secure Proxy
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
IBM Tivoli Monitoring
IBM Maximo Asset Management
IBM Rational Build Forge
Netcool/OMNIbus
IBM Cloud Application Performance Management (APM)
WebSphere eXtreme Scale
IBM Sterling Transformation Extender
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
java-1_8_0-ibm-alsa
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel
java-1_8_0-ibm
java-1_8_0-ibm-devel-32bit
java-1_8_0-ibm-32bit
java-1_8_0-ibm-src
java-1_8_0-ibm-demo
IBM Tivoli Application Dependency Discovery Manager
IBM Java SDK

Install updates from vendor's website.

OpenJ9 - update to 0.44.0
Tivoli Network Manager IP Edition - update to 4.2.0.20
IBM Tivoli Netcool Impact - update to 7.1.0.36
Tivoli Monitoring for Virtual Environments Base - update to 7.3.7
IBM Cognos Command Center - update to 10.2.5 IF3
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr8.35-30.129.1, 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr8.35-30.129.1, 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr8.35-30.129.1, 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr8.35-30.129.1, 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-devel-32bit - update to 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-32bit - update to 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-src - update to 1.8.0_sr8.35-150000.3.95.1
java-1_8_0-ibm-demo - update to 1.8.0_sr8.35-150000.3.95.1
IBM Cloud Transformation Advisor - update to 3.10.1
IBM Decision Optimization for Cloud Pak for Data - update to 5.0
IBM Sterling Secure Proxy - addressed in versions 6.0.3.1, 6.1.0.1
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.25, 6.2.0.24, 6.3.0.8
IBM Sterling Control Center - addressed in versions 6.2.1.0.14, 6.3.1.0.3
IBM Tivoli Monitoring - update to 6.3.0 FP7 Service Pack 6
Tivoli Network Configuration Manager IP Edition - update to 6.4.2.21
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.11
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF03
IBM Maximo Asset Management - update to 7.6.1.3.20
IBM Rational Build Forge - update to 8.0.0.27
IBM Java SDK - update to 8.0.8.25
IBM Semeru Runtimes - addressed in versions 8.0.412.0, 11.0.23.0, 17.0.11.0, 21.0.3.0
Netcool/OMNIbus - update to 8.1.0.33
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.27
Storage Protect Backup-Archive Client - update to 8.1.24
Storage Protect Server - update to 8.1.24
Storage Protect Operations Center - update to 8.1.24
WebSphere eXtreme Scale - update to 8.6.1.6 PH62624 iFix
IBM Sterling Transformation Extender - update to 11.0.1.0
IBM Business Automation Workflow - addressed in versions 21.0.3 IF034, 23.0.2 IF006
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 24.0.0-IF001

• https://gitlab.eclipse.org/security/cve-assignement/-/issues/21
• https://github.com/eclipse/omr/pull/7275

• Multiple vulnerabilities in IBM Semeru Runtime
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Permissions, privileges, and access controls in IBM SDK, Java Technology Edition
• Permissions, privileges, and access controls in IBM Maximo Asset Management
• Permissions, privileges, and access controls in IBM Engineering Lifecycle Engineering
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM i
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in WebSphere eXtreme Scale
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM Tivoli Network Configuration Manager update for IBM SDK, Java Technology Edition
• IBM Tivoli Netcool/OMNIbus update for Eclipse Openj9
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Cognos Command Center
• IBM Storage Protect Operations Center update for Eclipse Openj9
• IBM Storage Protect Server update for Eclipse Openj9
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• SUSE update for java-1_8_0-ibm
• SUSE update for java-1_8_0-ibm
• Multiple vulnerabilities in IBM Db2 Query Management Facility
• Multiple vulnerabilities in IBM Tivoli Monitoring for Virtual Environments Base
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM Sterling Transformation Extender
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• IBM Cloud Application Performance Management update for Eclipse Openj9
• Multiple vulnerabilities in IBM Cloud Transformation Advisor