CVE-2021-28167: 
Homebrew vulnerability analysis and mitigation

CVE-2021-28167 affects Eclipse OpenJ9 versions up to 0.25.0, where the usage of the jdk.internal.reflect.ConstantPool API causes the JVM to pre-resolve certain constant pool entries incorrectly. This vulnerability was discovered and reported on March 12, 2021 (MITRE). The vulnerability affects Eclipse OpenJ9 Java Virtual Machine implementations and has been assigned a CVSS score of 6.5 (Medium) (NETAPP).

The vulnerability stems from the JVM's handling of the jdk.internal.reflect.ConstantPool API, which in certain cases pre-resolves constant pool entries incorrectly. This behavior allows users to call static methods or access static members without executing the class initialization method. The technical implementation flaw is particularly evident when using methods like getMethodAtIfLoaded() and getMethodAt() in the ConstantPool API (GITHUB).

The vulnerability allows users to bypass class initialization methods and potentially observe uninitialized values. This can lead to accessing static members without proper initialization, which could result in unexpected behavior and potential security implications. The CVSS base score of 6.5 indicates moderate severity with potential impacts on both confidentiality and integrity (NETAPP).

The vulnerability can be exploited through the usage of the jdk.internal.reflect.ConstantPool API, specifically when accessing static methods or members. Detailed proof-of-concept code demonstrates that the vulnerability allows bypassing class initialization methods and accessing uninitialized values (GITHUB).

The vulnerability has been addressed in versions after Eclipse OpenJ9 0.25.0. Users are advised to upgrade to the latest version of Eclipse OpenJ9 that contains the fix (MITRE).