No security checking for UnsafeAccess.getInstance() in UnsafeAccessor
Description
UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up SecurityCheck.AccessLimiter for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when SecurityCheck.AccessLimiter is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom SecurityCheck.AccessLimiter is not set up. Version 1.7.0 contains a patch.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.github.karlatemp:unsafe-accessorMaven | >= 1.4.0, < 1.7.0 | 1.7.0 |
Affected products
1- Range: >= 1.4.0, < 1.7.0
Patches
14ef83000184eFix UnsafeAccess perm checking
2 files changed · +4 −3
api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java+2 −2 modified@@ -157,8 +157,8 @@ static class Secret { @Contract(pure = false) public static <T> T throw0(Throwable throwable) { if (throwable == null) throw new NullPointerException(); - getUnsafe().throwException(throwable); - throw new RuntimeException(); + Unsafe.getUnsafe0().throwException(throwable); + throw new RuntimeException(throwable); } /**
api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java+2 −1 modified@@ -17,7 +17,8 @@ public final class UnsafeAccess extends ProtectedObject { static final UnsafeAccess INSTANCE = new UnsafeAccess(); public static UnsafeAccess getInstance() { - SecurityCheck.getInstance(); + SecurityCheck.AccessLimiter accessLimiter = SecurityCheck.getInstance().getLimiter(); + if (accessLimiter != null) accessLimiter.preGetUnsafeAccess(); return INSTANCE; }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-cr6p-23cf-w9g9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-31139ghsaADVISORY
- github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fdghsax_refsource_MISCWEB
- github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0ghsax_refsource_MISCWEB
- github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.