In this post, we are going to discuss an important bug that existed in the Eclipse OMR project until version .4.. The vulnerability, identified as CVE-2025-1470, is related to NULL pointer dereferences and memory allocation failures in some internal port library and utilities consumers of z/OS atoe functions within the Eclipse OMR project. We will also go through the fixed implementation available from version .5. onwards, and share some tips on how developers can safeguard their code against such issues.

Background

Eclipse OMR is an open-source project that focuses on creating reusable and high-quality core components needed for building language runtimes like Java, Ruby, JavaScript, and more. In the OMR project, the atoe (ASCII to EBCDIC) functions are used to handle text conversion between ASCII and EBCDIC (Extended Binary Coded Decimal Interchange Code) encodings used in IBM mainframe systems.

Issue

In certain cases, OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes, making the software vulnerable to attacks.

The code snippet below shows an example of how the improper handling of return values from the atoe functions can cause a crash:

char *ebcdicString = atoe("Some ASCII String");
if (ebcdicString == NULL) {
    printf("Error: failed to convert string to EBCDIC\n");
} else {
    // Do something with the converted string
    free(ebcdicString);
}

Exploit Details

A malicious user could exploit this vulnerability by crafting inputs that result in the atoe function returning a NULL pointer. This would cause a crash, potentially leading to denial-of-service (DoS) attacks or allowing the attacker to execute arbitrary code.

Fix:
Starting from version .5., internal OMR consumers of atoe functions handle NULL return values and memory allocation failures correctly. The code snippet below shows the correct way to handle the possible NULL return value from the atoe function:

char *ebcdicString = atoe("Some ASCII String");
if (ebcdicString != NULL) {
    // Do something with the converted string
    free(ebcdicString);
} else {
    printf("Error: failed to convert string to EBCDIC\n");
}

- Eclipse OMR Project: https://www.eclipse.org/omr/
- IBM z/OS: https://www.ibm.com/it-infrastructure/z/zos
- CVE-2025-1470: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1470

Conclusion

To protect your software from CVE-2025-1470 or similar vulnerabilities, it is important to always validate the return values of functions that may return NULL pointers or indicate memory allocation failures. Additionally, ensure to upgrade the Eclipse OMR components in your projects to at least version .5., which includes the fix for this vulnerability. Happy coding!

Timeline

Published on: 02/21/2025 10:15:11 UTC
Last modified on: 03/05/2025 19:18:19 UTC