TI-2024-03671 Aliases CVE-2024-3933

Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer

LOW 31CWE-125Published 2024-05-27 · Updated 2024-08-01

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.arrayCopy on the IBM Z platform with hardware and software support for guarded storage [1], could allow access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. This allows read and write to addresses beyond the end of the array range.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00207 10th percentileScored 2026-11-07

Fix Fixed Open J9 (Eclipse Foundation): 0.44.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Open J9	0.13.0 to before 0.44.0	0.44.0	Patch available	CNA

Open J9 VendorEclipse Foundation Affected 0.13.0 to before 0.44.0 Fixed in 0.44.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eclipse:openj9::::::::	0.13.0 to before 0.44.0	Vulnerable	Eclipse Foundation

cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:* Versions 0.13.0 to before 0.44.0 Vulnerable ·Eclipse Foundation

Remediation

Fix · CNA Open J9 (Eclipse Foundation) Fixed in 0.44.0

Timeline

2026-10-02 Threatist record created from CVE-2024-3933

References

Patch 1

https://github.com/eclipse/omr/pull/7275

Advisory 1

https://gitlab.eclipse.org/security/cve-assignement/-/issues/21

TI-2026-06062 Out-of-bounds read in Eclipse OpenJ9 CVSS 4.0HIGH 8.7
TI-2021-09396 Missing initialization of resource in Eclipse OpenJ9 CVSS 3.1MEDIUM 6.5
TI-2018-09008 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
TI-2018-09006 Improper input validation in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8
TI-2021-17899 In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for… CVSS 3.1CRITICAL 9.8
TI-2019-08829 Out-of-bounds write in Eclipse OpenJ9 CVSS 3.0CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences