Bugzilla – Bug 1216339
VUL-0: CVE-2023-22025: java-17-openjdk, java-21-openjdk: memory corruption issue on x86_64 with AVX-512
Last modified: 2024-05-24 11:11:03 UTC
A memory corruption issue was found in JDK-21 on x86_64 with AVX-512. The issue seems to be caused by the calling of the super class's "Ideal()" method in "LoadVectorMaskedNode::Ideal()". Reference: https://mail.openjdk.org/pipermail/hotspot-compiler-dev/2023-September/068447.html http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22025
To prevent this, AVX512 instructions have been disabled in 21.0.1, a proper fix will be delivered with openjdk 21.0.2.
According to Oracle October 2023 CPU, this also affects java-1_8_0-openjdk and java-17-openjdk. [0] https://www.oracle.com/security-alerts/cpuoct2023.html
java-1_8_0-openjdk is not affected, only 17 and 21.
SUSE-SU-2023:4289-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (important) Bug References: 1214790, 1216339, 1216374 CVE References: CVE-2023-22025, CVE-2023-22081 Sources used: openSUSE Leap 15.4 (src): java-17-openjdk-17.0.9.0-150400.3.33.1 openSUSE Leap 15.5 (src): java-17-openjdk-17.0.9.0-150400.3.33.1 Basesystem Module 15-SP4 (src): java-17-openjdk-17.0.9.0-150400.3.33.1 Basesystem Module 15-SP5 (src): java-17-openjdk-17.0.9.0-150400.3.33.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4572-1: An update that solves four vulnerabilities and has two security fixes can now be installed. Category: security (important) Bug References: 1204264, 1216339, 1216374, 1216379, 1216640, 1217214 CVE References: CVE-2023-22025, CVE-2023-22067, CVE-2023-22081, CVE-2023-5676 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4614-1: An update that solves four vulnerabilities and has two security fixes can now be installed. Category: security (important) Bug References: 1204264, 1216339, 1216374, 1216379, 1216640, 1217214 CVE References: CVE-2023-22025, CVE-2023-22067, CVE-2023-22081, CVE-2023-5676 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixed, please close.
Released. Closing bug.