CVE-2021-41041: vulnerability in The Eclipse Foundation Eclipse OpenJ9
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.1%
In short
Eclipse Openj9 fails to properly report errors when verifying Java bytecode during MethodHandle calls, potentially allowing unsafe code to run without being caught.
Technical detail
CVE-2021-41041 involves improper exception handling (CWE-252) during bytecode verification in Openj9 when triggered via MethodHandle invocation. An attacker can craft bytecode that bypasses verification checks, leading to execution of unverified methods with potential memory corruption or privilege escalation impacts.
Summary generated and translated by AI from the official description.
In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.
Affected products
The Eclipse Foundation · Eclipse OpenJ9Related CVEs — The Eclipse Foundation Eclipse OpenJ9
In the same product, most dangerous first.