CVE-2017-10285

app("2017 OCTOBER CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2017-10285 (2017 OCTOBER CPU)

        CVSS 3.0 Summary:
            Base Score              | 9.6 HIGH
            Attack Vector           | Network
            Attack Complexity       | Low
            Privileges Required     | None
            User Interaction        | Required
            Scope                   | Changed
            Confidentiality Impact  | High
            Integrity Impact        | High
            Availability Impact     | High

        Description:
            A flaw was found in the privileged code used to handle unreferenced
            objects in the Target class in the RMI component of Oracle Hotspot.
            An untrusted Java application or applet could use this flaw to bypass
            Java sandbox restrictions.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=1501868

        Affected Versions:
            6u161, 7u151, 8u144

        Tested Versions:
            6u0 - 6u161
            7u0 - 7u151
            8u0 - 8u144

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2017-10285 :01"):
        function("sun/rmi/transport/Target.refSetRemove(Ljava/rmi/dgc/VMID;)V",
            checksums: ["854aa58e99"]) // 6u0 - 6u161, 7u0 - 7u151, 8u0 - 8u144
        callreturn("sun/rmi/transport/Target.getImpl()Ljava/rmi/Remote;")

        code(language: java,   import: ["java.rmi.Remote",
                                        "java.security.AccessController",
                                        "sun.rmi.runtime.NewThreadAction",
                                        "java.security.PrivilegedAction",
                                        "java.security.AccessControlContext",
                                        "java.rmi.server.Unreferenced"]):

            private static JavaField cclField;
            private static JavaField accField;
            private static JavaField nextThreadNumField;

            public void load() {
                cclField = JavaField.load("sun/rmi/transport/Target.ccl");
                accField = JavaField.load("sun/rmi/transport/Target.acc");
                nextThreadNumField = JavaField.load("sun/rmi/transport/Target.nextThreadNum");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                Remote obj = (Remote) frame.loadObjectOperand(0);
                if (obj instanceof Unreferenced) {
                    final Unreferenced unrefObj = (Unreferenced) obj;
                    final ClassLoader ccl = (ClassLoader) cclField.readObject(self);
                    final AccessControlContext acc = (AccessControlContext) accField.readObject(self);
                    int nextThreadNum = nextThreadNumField.readInt();

                    AccessController.doPrivileged(
                        new NewThreadAction(new Runnable(){
                            public void run() {
                                Thread.currentThread().setContextClassLoader(ccl);
                                AccessController.doPrivileged(new PrivilegedAction<Void>(){
                                    public Void run() {
                                        unrefObj.unreferenced();
                                        return null;
                                    }
                                }, acc);
                            }
                        }, "Unreferenced-" + nextThreadNum++, false, true)).start();
                }
                frame.storeObjectOperand(0, null);
            }
        endcode
    endpatch

endapp