jre8-openjdk-headless: sandbox escape

ID ASA-201603-27
Type archlinux
Reporter Arch Linux
Modified 2016-03-29T00:00:00


It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism.