Java4Shell

Presented to you by Calif Research

Write Once, Run Everywhere

You did everything right. On certain modern CPUs, a bug in Java itself can still let an attacker run code on your server.

[ CHECK YOUR SERVER ][ READ THE RESEARCH ]

PLATFORMHOTSPOT / x86-64 / VBMI + BMI2

AFFECTED SYSTEMS_

Java sits behind software builds, company logins, search, internal wikis, and web applications. Server access can expose source code, deployment credentials, login keys, and private data.

Exposure requires an unpatched x86-64 HotSpot JVM, AVX-512 VBMI/BW, BMI2, and an application path that decodes untrusted Base64.

AMD

Zen 4 and newer processors with AVX-512 enabled, including EPYC 9004/9005/9006 and Ryzen 7000/9000 desktop parts. Check the CPU flags; firmware may disable AVX-512.

EPYC 9004 EPYC 9005 EPYC 9006

INTEL

3rd-generation Xeon Ice Lake, 4th-generation Sapphire Rapids, 5th-generation Emerald Rapids, and Xeon 6 P-cores. On PCs, check 10th- and 11th-generation Core models with AVX-512, including Ice Lake and Tiger Lake. Xeon 6 E-cores and older Xeons without VBMI do not use this path.

XEON ICE LAKE XEON 6 10TH GEN CORE 11TH GEN CORE

CLOUD INSTANCES

Cloud instance families with CPUs capable of the affected x86 decoder path
PROVIDER	FAMILIES TO CHECK
GOOGLE CLOUD	Intel: C3, C4, N4, and N2 on Ice Lake. AMD: C3D, C4D, N4D, H4D.N2 can also use Cascade Lake; check its actual CPU platform.
AWS EC2 C M R SPECS	Intel: C6i/M6i/R6i, C7i/M7i/R7i, C8i/M8i/R8i. AMD: C7a/M7a/R7a, C8a/M8a/R8a.
AZURE	Dv5/Dsv5 and Ev5/Esv5 on Ice Lake or Sapphire Rapids; AMD Dasv6 and Easv6 on Genoa.
ORACLE CLOUD	Intel Standard3 and AMD Standard.E5 / Standard.E6, including their Flex VM shapes.

This x86 bug does not affect AWS Graviton or Google Axion.

READ-ONLY CHECK

CHECK CPU
FEATURES

Run inside the VM or container.

grep -m1 '^flags' /proc/cpuinfo | tr ' ' '\n' | grep -E '^(avx512f|avx512bw|avx512vl|avx512vbmi|bmi2)$'

The output must include all five flags.

MITIGATION_

Append one flag to your JVM options, then restart the service.

Limit the JVM to AVX2

-XX:UseAVX=2

Keeps AVX2 and disables AVX-512 throughout that JVM.

ALTERNATIVE

Disable Base64 intrinsics

-XX:-UseBASE64Intrinsics

Disables optimized Base64 while leaving other AVX-512 optimizations available.

Verify UseAVX = 2 or UseBASE64Intrinsics = false with jcmd 1234 VM.flags -all. Install your vendor’s fixed JDK when available.

JVM OPTIONS

RESEARCH FILES_

How the same Java bug reaches build systems, package repositories, company logins, source-code review, IoT platforms, and ordinary web applications.

Public use gives a sense of scale: Netflix uses Java and Spring Boot, Android and Chromium use Gerrit, and NASA’s JPL uses Jira and Confluence. The demonstrations below use our own deployments.

BASE64TAIL UNDERFLOW

An AVX-512 tail-length underflow enables a 64-byte store past the output array. Java throws only after the write.

MINIMAL INPUTBase64.getDecoder().decode("A".repeat(64) + "=");

INTRINSIC TRACEHOTSPOT / x86-64

ONE BLOCK = ONE BYTE / OFFSETS IN HEX

OUTPUT ALLOCATION

Java output array

50BYTES ALLOCATED

DESTINATION0000–003150 B

VECTOR STORE0030–006F64 B

OVERWRITE0032–006F62 B

The allocating decoder reserves 50 bytes for 64 valid characters followed by a single padding character.

░▒▓AFFECTED SYSTEMS_

AMD