CVE-2018-2800

app("2018 APRIL CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2018-2800 (2018 APRIL CPU)

        CVSS 3.0 Summary:
            Base Score              | 4.2 MEDIUM
            Attack Vector           | Network
            Attack Complexity       | High
            Privileges Required     | None
            User Interaction        | Required
            Scope                   | Unchanged
            Confidentiality Impact  | Low
            Integrity Impact        | Low
            Availability Impact     | None

        Description:
            It was discovered that the RMI component of OpenJDK enabled HTTP
            transport for RMI servers by default. This could possibly expose RMI
            services to attackers who can not connect to them directly by
            attacking web browsers of users able to directly connect to the
            services. The fix for this issue disables the use of RMI HTTP
            transport by default. System property
            java.rmi.server.disableIncomingHttp (with the default value of
            "true") can be used to enable HTTP transport.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=1568163

        Affected Versions:
            6u181, 7u171, 8u162, JRockit R28.3.17

        Tested Versions:
            6u0 - 6u181
            7u0 - 7u171
            8u0 - 8u162

        Protection Provided:
            Functional (default), Alerting

        Patch Version:
            1.1
    ***************************************************************************/

    patch("CVE-2018-2800 :01"):
        function("sun/rmi/transport/tcp/TCPTransport$ConnectionHandler.run0()V",
            checksums: ["c6311a8fa1",   // 6u0  - 6u85,  7u0  - 7u72, 8u0   - 8u25
                        "98b9c6c15c",   // 6u91 - 6u181, 7u75 - 7u171
                        "40a95593e2",   //              8u31
                        "d5cf73fc8a",   //              8u40
                        "970bf37f52",   //              8u45, 8u71
                        "6657867f84",   //              8u51, 8u72, 8u74  - 8u91
                        "2db9f73cac",   //              8u60
                        "6b6a263839",   //              8u65
                        "c13c86b2e5",   //              8u66
                        "7cab537e97",   //              8u73
                        "72ec483133"])  //              8u92  - 8u162
        callreturn("java/io/DataInputStream.readInt()I",
            occurrences: [1])

        code(language: java,   import: ["java.rmi.RemoteException"]):
            private static final boolean ALERTING_MODE = false;
            private static int POST;
            private static boolean shouldInit = true;

            private void init() {
                POST = JavaField.load("sun/rmi/transport/tcp/TCPTransport$ConnectionHandler.POST")
                                .readInt(null);
                shouldInit = false;
            }

            public void patch(JavaFrame frame) {
                if (shouldInit) {
                    init();
                }

                int magic = frame.loadIntOperand(0);
                if (magic != POST) {
                    return;
                }

                if (ALERTING_MODE) {
                    ArmrEvent event = ArmrEvent.load("Execute Rule", "medium");
                    event.addExtension("suser", System.getProperty("user.name", ""));
                    event.addExtension("msg", "RMI over HTTP was performed as system property `java.rmi.server.disableIncomingHttp` was set to false");
                    event.addExtension("act", "allow");
                    event.commit();
                } else {
                    System.err.println("DISABLED: true");
                    frame.raiseException(new RemoteException("RMI over HTTP is disabled"));
                }
            }
        endcode
    endpatch

endapp