CVE-2020-2583

app("2020 JANUARY CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2020-2583 (2020 JANUARY CPU)

        CVSS 3.0 Summary:
            Base Score              | 3.7 LOW
            Attack Vector           | Network
            Attack Complexity       | High
            Privileges Required     | None
            User Interaction        | None
            Scope                   | Unchanged
            Confidentiality Impact  | None
            Integrity Impact        | None
            Availability Impact     | Low

        Description:
            A flaw was found in the what the BeanContextSupport class in the
            Serialization component of OpenJDK handled exceptions during
            deserialization. A specially-crafted input could cause a Java
            application to use an excessive amount of resources when
            deserialized.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-2583
            http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/b76e1348c535

        Affected Operating System:
            Any

        Affected Versions:
            7u241, 8u231, 11u5, 13u1

        Fixed Version:
            7u251, 8u241, 11u6, 13u2

        Tested Versions:
            6u0 - 6u211
            7u0 - 7u241
            8u0 - 8u231

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2020-2583 :01"):
        function("java/beans/beancontext/BeanContextSupport.readChildren(Ljava/io/ObjectInputStream;)V",
            checksums: ["d3744dbc02"])  // 6u0 - 6u211, 7u0 - 7u241, 8u0 - 8u231
        entry()

        code(language: java,   import: ["java.beans.PropertyChangeListener",
                                        "java.beans.PropertyVetoException",
                                        "java.beans.VetoableChangeListener",
                                        "java.beans.beancontext.BeanContext",
                                        "java.beans.beancontext.BeanContextChild",
                                        "java.beans.beancontext.BeanContextSupport",
                                        "java.io.IOException",
                                        "java.io.ObjectInputStream"]):
            private static JavaField serializableField;
            private static JavaField childPCLField;
            private static JavaField childVCLField;
            private static JavaMethod childDeserializedHookMethod;
            private static boolean shouldInit = true;

            public void init() {
                serializableField = JavaField.load("java/beans/beancontext/BeanContextSupport.serializable");
                childPCLField = JavaField.load("java/beans/beancontext/BeanContextSupport.childPCL");
                childVCLField = JavaField.load("java/beans/beancontext/BeanContextSupport.childVCL");
                childDeserializedHookMethod = JavaMethod.load("java/beans/beancontext/BeanContextSupport.childDeserializedHook(Ljava/lang/Object;Ljava/beans/beancontext/BeanContextSupport$BCSChild;)V");
                shouldInit = false;
            }

            public void patch(JavaFrame frame) {
                if (shouldInit) {
                    init();
                }
                BeanContextSupport self = (BeanContextSupport) frame.loadThisVariable();
                ObjectInputStream ois = (ObjectInputStream) frame.loadObjectVariable(1);
                int serializable = serializableField.readInt(self);
                PropertyChangeListener childPCL = (PropertyChangeListener) childPCLField.readObject(self);
                VetoableChangeListener childVCL = (VetoableChangeListener) childVCLField.readObject(self);

                try {
                    readChildren(self, ois, serializable, childPCL, childVCL);
                } catch (IOException ex) {
                    frame.raiseException(ex);
                } catch (ClassNotFoundException ex) {
                    frame.raiseException(ex);
                }
                frame.returnVoid();
            }

            private void readChildren(BeanContextSupport self, ObjectInputStream ois, int serializable,
                                      PropertyChangeListener childPCL, VetoableChangeListener childVCL)
                    throws IOException, ClassNotFoundException {

                int count = serializable;
                while (count-- > 0) {
                    Object child = ois.readObject();
                    Object bscc = ois.readObject();

                    synchronized (child) {
                        BeanContextChild bcc = null;
                        try {
                            bcc = (BeanContextChild) child;
                        } catch (ClassCastException cce) {
                            // do nothing
                        }
                        if (bcc != null) {
                            try {
                                bcc.setBeanContext(self.getBeanContextPeer());
                                bcc.addPropertyChangeListener("beanContext", childPCL);
                                bcc.addVetoableChangeListener("beanContext", childVCL);
                            } catch (PropertyVetoException pve) {
                                continue;
                            }
                        }
                        childDeserializedHookMethod.call(self, child, bscc);
                    }
                }
            }
        endcode
    endpatch

endapp