CVE-2017-10686

What it actually does

Multiple heap use-after-free conditions in NASM token() allocation and detoken()/pp_getline() freeing, enabling corrupted double-linked lists, double-free, out-of-bounds writes, and potential remote code execution when processing crafted input.

Why it matters to the business

Attackers could achieve arbitrary code execution on developer or build systems that invoke the vulnerable assembler, risking supply-chain compromise for any software built with affected packages; the issue affects many downstream OpenJDK distributions despite low current exploit probability.

How an attack unfolds

An attacker supplies a malicious assembly source file to NASM; the token heap buffer is freed during preprocessing and then reused in delete_Token or later detoken calls, corrupting memory structures to achieve code execution without authentication.

How to fix it

Upgrade all listed packages to the fixed versions: openjdk-17 (Chainguard/Wolfi) 17.0.5.8-r4 and equivalent fixed builds for dbg, default-jdk, default-jvm, demos, doc, jmods, jre, and jre-base variants.

How to confirm the fix worked

Confirm package versions match or exceed 17.0.5.8-r4 on Chainguard and Wolfi systems; re-run NASM on known triggering inputs and verify absence of heap corruption in sanitized builds.

Typical attack path

1. Identify or induce use of NASM on untrusted .asm input
2. Craft input that triggers repeated token allocation/free cycles
3. Trigger use-after-free paths in detoken or delete_Token to corrupt heap metadata
4. Leverage resulting OOB write or double-free for arbitrary code execution

How to detect it

Review build logs and process execution history for NASM invocations on untrusted sources; look for heap-related crashes or sanitizer reports referencing token or detoken functions.

What your security team should do

• Immediately update all affected OpenJDK packages to 17.0.5.8-r4 or later
• Scan build pipelines and developer workstations for older NASM versions
• Restrict NASM execution to trusted inputs until patches are deployed