CVE-2022-2191: Jetty SslConnection does not release pooled ByteBuffers in case of errors

Background

The org.eclipse.jetty:jetty-server package is an open-source Java HTTP server and servlet container. It provides a powerful and flexible server framework for building web applications. The package is widely used in various Java-based web applications and frameworks. However, a vulnerability has been discovered in the package that affects versions 10.0.0 to 10.0.10 and 11.0.0 to 11.0.10.

Vulnerability Detail

The vulnerability in the org.eclipse.jetty:jetty-server package lies in the SslConnection class, which fails to release ByteBuffers in case of error code paths. This can lead to memory leaks when TLS handshakes encounter errors, such as when clients with expired certificates attempt client-authentication. The leaked ByteBuffers can accumulate and consume excessive memory resources. The impact of this vulnerability can result in increased memory usage and potential denial-of-service conditions.

Workaround

If upgrading to the latest version is not immediately feasible, a workaround can be implemented by configuring a RetainableByteBufferPool with specific memory limits. This will help limit the amount of memory that can be leaked. Here is an example of how to configure the pool with embedded Jetty:

int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();

For Jetty with jetty-home/jetty-base, a configuration file retainable-byte-buffer-config.xml needs to be created in the ${jetty.base}/etc/ directory. The file should contain the following XML configuration:

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>

This configuration file should be referenced in the ${jetty.base}/start.d/retainable-byte-buffer-config.ini file:

etc/retainable-byte-buffer-config.xml

These workarounds will help mitigate the memory leak issue until the package can be updated.

Conclusion

The org.eclipse.jetty:jetty-server package is vulnerable to a memory leak issue in the SslConnection class. Upgrading to the latest version of the package (10.0.11 or 11.0.11 or later) is the recommended solution. If immediate upgrade is not possible, implementing the provided workaround can help mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.eclipse.jetty:jetty-server →

FAQ