The bytecode verifier is an internal component of the JVM and is responsible for detecting non-confirming Java code. It ensures that the class file is in proper format, that illegal type casts are not performed and prevents operand stack overflows or underflows. Users sometimes, assume safe runtime environments and forgo bytecode verification by disabling it. This practice is extremely dangerous.

Noncompliant Code Example

The verification process is automatically initiated unless the -Xverify:none flag is specified on the command line. This noncompliant example uses this flag.

java -Xverify:none application.java

Compliant Solution

Bytecode verification happens by default in most implementations. If it doesn't, the -Xverify:all flag can be specified on the java command line.

On Java 2 systems, classes loaded by the primordial class loader (that loads classes from the boot class path) are not required to perform bytecode verification. The verification is automatically performed when a classloader loads a class dynamically.

Risk Assessment

The code that is not subject to bytecode verification can bypass security checks that are normally expected to be performed by Java code.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Oaks 01|AA. Java References#Oaks 01]\] The Bytecode Verifier
\[[Pistoia 04|AA. Java References#Pistoia 04]\] Section 7.3, The Class File Verifier

OBJ36-J. Provide mutable classes with a clone method      00. Security (SEC)      02. Declarations and Initialization (DCL)