CVE-2023-5676 Eclipse OpenJ9 possible infinite busy hang
An attacker can cause a denial of service by sending a shutdown signal during JVM initialization, leading to an infinite hang or crash.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5676?
CVE-2023-5676 is a medium-severity vulnerability in Eclipse Foundation OpenJ9, published on 15 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.
Which versions are affected by CVE-2023-5676?
It affects 1 product.
Products include Eclipse Openj9.
How do I fix CVE-2023-5676?
Upgrade to a fixed version.
Is CVE-2023-5676 being exploited?
There is no known exploitation of CVE-2023-5676 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Foundation OpenJ9
Sources
Also known as GHSA-5ch2-qvr7-76ch.