CVE-2022-31139 No security checking for UnsafeAccess.getInstance() in UnsafeAccessor
Untrusted code can bypass access restrictions on UnsafeAccessor when a specific security limiter is configured, allowing unauthorized access to internal data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31139?
CVE-2022-31139 is a medium-severity vulnerability in Karlatemp UnsafeAccessor, published on 11 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch.
Which versions are affected by CVE-2022-31139?
2 open source packages ship an affected version, including io.github.karlatemp:unsafe-accessor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.github.karlatemp:unsafe-accessor Maven | From 1.4.0 | 1.7.0 |
io.github.karlatemp:unsafe-accessor Maven | From 1.4.0 | 1.7.0 |
Products include Unsafe Accessor Project Unsafe Accessor.
How do I fix CVE-2022-31139?
Upgrade io.github.karlatemp:unsafe-accessor to 1.7.0 or later.
Is CVE-2022-31139 being exploited?
There is no known exploitation of CVE-2022-31139 in the wild and no public exploit code.
Sources
Also known as GHSA-cr6p-23cf-w9g9.