CVE-2020-2816

app("2020 APRIL CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2020-2816 (2020 APRIL CPU)

        CVSS 3.0 Summary:
            Base Score              | 7.5 HIGH
            Attack Vector           | Network
            Attack Complexity       | Low
            Privileges Required     | None
            User Interaction        | None
            Scope                   | Unchanged
            Confidentiality Impact  | None
            Integrity Impact        | High
            Availability Impact     | None

        Description:
            It was discovered that the TLS/SSL implementation in the JSEE
            component of OpenJDK did not properly handle application data
            packets received prior to the handshake completion. This could
            allow unauthorized injection of data at the beginning a TLS session.

        Resources:
            https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixJAVA
            https://bugzilla.redhat.com/show_bug.cgi?id=1823853
            http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/517f0515f160

        Affected Operating System:
            Any

        Affected Versions:
            11u6, 14u0

        Fixed Versions:
            11u7, 14u1

        Tested Versions:
            11u0 - 11u6

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2020-2816 :01"):
        function("sun/security/ssl/SSLTransport.decode(Lsun/security/ssl/TransportContext;[Ljava/nio/ByteBuffer;II[Ljava/nio/ByteBuffer;II)Lsun/security/ssl/Plaintext;",
            checksums: ["eb9248f223"])  // 11u0 - 11u6
        instruction(277)   // 277: ifnonnull 288

        code(language: java,   import: ["javax.net.ssl.SSLException"]):
            private byte id;
            private Object UNEXPECTED_MESSAGE;
            private JavaField contentTypeField;
            private JavaField isNegotiatedField;
            private JavaMethod fatalMethod;
            private boolean shouldInit = true;

            public void init() {
                Object applicationData = JavaField.load("sun/security/ssl/ContentType.APPLICATION_DATA")
                                                  .readObject(null);
                id = JavaField.load("sun/security/ssl/ContentType.id")
                              .readByte(applicationData);
                UNEXPECTED_MESSAGE = JavaField.load("sun/security/ssl/Alert.UNEXPECTED_MESSAGE")
                                              .readObject(null);
                contentTypeField = JavaField.load("sun/security/ssl/Plaintext.contentType");
                isNegotiatedField = JavaField.load("sun/security/ssl/TransportContext.isNegotiated");
                fatalMethod = JavaMethod.load("sun/security/ssl/TransportContext.fatal(Lsun/security/ssl/Alert;Ljava/lang/String;)V");
                shouldInit = false;
            }

            public void patch(JavaFrame frame) {
                if (shouldInit) {
                    init();
                }

                Object plainText = frame.loadObjectOperand(0);
                if (plainText == null) {
                    return;
                }

                byte contentType = contentTypeField.readByte(plainText);
                if (contentType == id) {
                    Object context = frame.loadObjectVariable(0);
                    if (!isNegotiatedField.readBoolean(context)) {
                        try {
                            fatalMethod.call(context, UNEXPECTED_MESSAGE, "Receiving application data before handshake complete");
                        } catch (Throwable ex) {
                            frame.raiseException(ex);
                        }
                    }
                }
            }
        endcode
    endpatch

endapp