CVE-2024-23084

Executive Summary

CVE-2024-23084 is a disputed vulnerability reported in Apfloat v1.10.1, a Java arbitrary-precision floating-point library. The claim involves an ArrayIndexOutOfBoundsException in the org.apfloat.internal.DoubleCRTMath::add(double[], double[]) method. Multiple third parties have contested the finding, stating there was insufficient evidence to confirm a security vulnerability. The CVSS score is 0.0, and no exploit code, proof-of-concept, or patch has been published. The EPSS score is 0.0%, indicating no active exploitation in the wild. This report treats the issue as a potential denial-of-service (DoS) vector if triggered by malformed input, but the disputed nature means it may be a false positive from automated analysis.

Supply Chain & Package Security

Apfloat is a Java library distributed via Maven Central. No official advisory, CVE patch, or version update has been released. Users should monitor the project repository for any future fixes. The disputed status reduces immediate supply chain risk, but the lack of a patch means any confirmed vulnerability would remain unaddressed.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (None)
• Vector: UNKNOWN
• Attack Vector: UNKNOWN
• Attack Complexity: UNKNOWN
• Privileges Required: UNKNOWN
• User Interaction: UNKNOWN
• Scope: UNKNOWN
• Confidentiality Impact: NONE
• Integrity Impact: NONE
• Availability Impact: NONE (disputed)

Threat Level: Low (disputed, no exploit, no patch, no active exploitation).

Deep Dive & Mechanics

The reported vulnerability lies in the DoubleCRTMath.add() method, which performs element-wise addition of two double[] arrays. An ArrayIndexOutOfBoundsException can occur if the input arrays have mismatched lengths or if an index is accessed beyond the array bounds. In a typical usage scenario, this would be a programming error rather than a security flaw. However, if the library processes untrusted input (e.g., user-supplied array sizes), an attacker could craft input to cause an unhandled exception, leading to a denial-of-service condition.

The disputed nature suggests the reporter may have used a static analysis tool that flagged a potential out-of-bounds access without confirming it is exploitable. The library's internal methods are not directly exposed to external input in standard use, reducing the attack surface.

Vulnerable vs. Patched Code

Vulnerable Code (Apfloat v1.10.1):

// org.apfloat.internal.DoubleCRTMath.java
public void add(double[] a, double[] b) {
    for (int i = 0; i < a.length; i++) {
        a[i] += b[i]; // Potential ArrayIndexOutOfBoundsException if b.length < a.length
    }
}

Patched Code (Hypothetical):

public void add(double[] a, double[] b) {
    int minLen = Math.min(a.length, b.length);
    for (int i = 0; i < minLen; i++) {
        a[i] += b[i];
    }
}

No official patch exists. The above is a defensive fix that would prevent the exception by iterating only up to the shorter array length.

Exploitation & Lab Setup

Red Team

No public exploit exists. To test for DoS potential, an attacker would need to craft input that triggers the add() method with mismatched array lengths. Example:

import org.apfloat.internal.DoubleCRTMath;

public class Exploit {
    public static void main(String[] args) {
        DoubleCRTMath math = new DoubleCRTMath();
        double[] a = new double[10];
        double[] b = new double[5]; // Shorter array
        math.add(a, b); // Triggers ArrayIndexOutOfBoundsException
    }
}

This would cause an unhandled exception, potentially crashing the application if not caught.

Blue Team

• Monitor logs for ArrayIndexOutOfBoundsException in Apfloat-related code.
• Validate all array lengths before passing to Apfloat methods.
• Use a security manager or exception handler to prevent crashes.
• Consider replacing Apfloat with an actively maintained alternative if the vulnerability is confirmed.

Indicators of Compromise (IOCs)

• Log Entry: java.lang.ArrayIndexOutOfBoundsException: Index 5 out of bounds for length 5 (or similar) in stack traces involving org.apfloat.internal.DoubleCRTMath.add.
• Network: No network IOCs; this is a local DoS vector.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_23084_Apfloat_ArrayIndexOutOfBounds {
    meta:
        description = "Detects potential exploitation of CVE-2024-23084 in Apfloat v1.10.1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23084"
    strings:
        $s1 = "org.apfloat.internal.DoubleCRTMath" ascii wide
        $s2 = "ArrayIndexOutOfBoundsException" ascii wide
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2024-23084 Apfloat ArrayIndexOutOfBoundsException
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects ArrayIndexOutOfBoundsException in Apfloat DoubleCRTMath.add
author: Valters IT
date: 2025-04-10
logsource:
    product: java
    service: application
detection:
    selection:
        ExceptionClass: "java.lang.ArrayIndexOutOfBoundsException"
        StackTrace|contains: "org.apfloat.internal.DoubleCRTMath.add"
    condition: selection
falsepositives:
    - Legitimate programming errors in non-security contexts
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23084 Apfloat DoS Attempt"; flow:to_server; content:"ArrayIndexOutOfBoundsException"; content:"DoubleCRTMath"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Validate all array lengths before calling Apfloat methods. Wrap calls in try-catch blocks to handle exceptions gracefully.
• Short-term: Monitor the Apfloat repository for any official patch or advisory. Consider forking the library and applying the defensive fix shown above.
• Long-term: Evaluate alternative arbitrary-precision libraries (e.g., JScience, or Java's built-in BigDecimal/BigInteger) if the vulnerability is confirmed and no patch is provided.
• No patch available from the vendor as of this report.

Valters IT
Securing Digital Frontiers