Eclipse OpenJ9 <0.41.0: Shutdown Signal Can Cause Infinite Busy Spin or Crash
CVE-2023-5676 Published on November 15, 2023
In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.
Vulnerability Analysis
CVE-2023-5676 is exploitable with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Signal Handler Race Condition
The software uses a signal handler that introduces a race condition.
Products Associated with CVE-2023-5676
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-5676 are published in Eclipse Openj9:
Affected Versions
Eclipse Foundation OpenJ9:- Before 0.41.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.