Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
eclipse-openj9/openj9
master @ 592b33e
141
Fixes
21
CVEs
CRITICAL
Peak severity
16.2%
Coverage
Highlights
Auth Bypass: 44 prior fixes. Scrutinize any change in this area.
jcl/src/java.base/share/classes/java/lang/invoke/MethodHandles.java: most-fixed (6 issues). Treat as high-risk during review.
105 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The MethodHandle resolution and lookup infrastructure frequently fails to validate access controls, module boundaries, and class access flags, leading to direct access-control and sandbox bypasses. Security policies must be rigorously combined rather than skipped on internal invocation paths.
Memory Corruption: Incorrect memory offset calculations, missing narrowing/mask operations on narrow fields, and incorrect register/stack alignment during JIT compiler code generation and native downcalls consistently lead to stack or heap corruption.
Sandbox Escape: Flaws in the JVM bytecode verifier can allow malicious classes to bypass critical semantic validation rules (such as array receiver compatibility, field initialization sequences, or unmodifiable class blocks), leading to arbitrary bytecode execution.