Buffer Overflow Vulnerability in OpenJ9 Prior to 0.44.0 and After 0.13.0

CVE-2024-3933

What is CVE-2024-3933?

Eclipse OpenJ9 prior to version 0.44.0 and after 0.13.0 contains a buffer overflow vulnerability impacting the IBM Z platform. When using the JVM option -Xgc:concurrentScavenge, the 'System.arrayCopy' function may generate an incorrect length value due to overlapping source and destination memory regions. This flaw occurs during the Concurrent Scavenge Garbage Collection process, leading to the risk of unauthorized memory access, which can compromise sensitive data and system integrity.

References