Infinite Loop in OW2 ASM 9.11 Before 9.11.1

Executive Summary

OW2 ASM 9.11 before 9.11.1 has an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses OW2 ASM versions before 9.11.1. Inspect Java applications or build tools that rely on ASM for bytecode manipulation. Look for processes hanging during class file processing, especially when handling large methods exceeding 64 KB.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by hanging ClassReader.accept() when processing maliciously crafted class files. It disrupts services for build tools, instrumenters, agents, or analyzers that rely on ASM for bytecode manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes denial-of-service conditions by hanging ClassReader.accept() during class file processing, which could disrupt services handling sensitive data. For GDPR, this may impact availability of systems processing personal data, potentially violating Article 32 requirements for resilience. For HIPAA, service disruptions could affect systems handling protected health information, potentially compromising access controls or integrity of ePHI processing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to OW2 ASM version 9.11.1 or later. Review and update all Java applications, build tools, or libraries using ASM to ensure they use the patched version. Monitor for hanging processes during class file processing as a potential sign of exploitation.

Useful 0 Not Useful 0