Skip to content

CVE-2021-43859 fix seems to incorrectly calculate elapsed time #282

Open
@jtnord

Description

@jtnord

As I understand the code at e8e8862#diff-ac0a4639bfa0a500bff9ac99c66eaf68c7bcfd92e3b043495844ebe88792024cR38-R55 uses System.currenttime() for the timing of the calls.

However System.currentTimeMillis() should never be used for call timing - as it will not give you correct results.
currentTimeMills() will be affected by clock changes (as it represents wall clock) on the OS, this may be NTP adjusting the close (via a skew so timing runs faster than it real time), or a step adjustment in the case of periodic clock resync (without spreading the difference over a period).

So in the case of an abrupt clock jump forward the code could think that there had been a lot longer spent inside the function that actually occurred, causing incorrect interruptions of the deserialization.

The fix would be to switch to System.nanoTime() which is independent of wall clock and hence clock drift

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions