CVE-2022-31139 Information

Description

UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally if UA is loaded as a named module the internal data of UA is protected by JVM and others can only access UA via UA’s standard API. The main application can set up SecurityCheck.AccessLimiter for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0 when SecurityCheck.AccessLimiter is set up untrusted code can access UA without limitation even when UA is loaded as a named module. This issue does not affect those for whom SecurityCheck.AccessLimiter is not set up. Version 1.7.0 contains a patch.

Reference

https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0 https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9