Excessive Memory Allocation in OW2 ASM

Executive Summary

OW2 ASM 5.0 before 9.11 has an excessive memory allocation flaw in ClassReader.readBootstrapMethodsAttribute(). It sizes an int array from num_bootstrap_methods without checking attribute_length. Attackers exploit this by sending a 100-byte crafted class file, forcing the JVM to allocate about 2 GB of memory, leading to OutOfMemoryError crashes or resource exhaustion.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking the ASM library version in use. If your system uses ASM 5.0 through 9.10, it is vulnerable. Commands to check include: for Maven projects, run 'mvn dependency:tree | grep asm'; for Gradle projects, run 'gradle dependencies | grep asm'; or inspect the JAR files in your classpath for 'asm-*.jar' and check the version in the manifest or filename.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash the JVM or consume excessive system resources when processing a malicious class file. It may disrupt applications relying on ASM, cause denial-of-service conditions, or degrade system performance due to high memory usage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a denial-of-service issue causing resource exhaustion rather than a data breach or privacy violation. However, it could indirectly impact compliance by disrupting system availability, which may violate availability requirements in regulations like GDPR Article 32 or HIPAA Security Rule requirements for access control and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ASM to version 9.11 or later immediately. This version includes validation for BootstrapMethods attribute length and other security fixes. If upgrading is not possible, restrict access to systems using ASM or implement runtime monitoring to detect and terminate processes consuming excessive memory.

Useful 0 Not Useful 0