Bug 60030 - Run away CPU with JSSE / OpenSSL with IE8
Summary: Run away CPU with JSSE / OpenSSL with IE8
Status: RESOLVED REMIND
Alias: None
Product: Tomcat 8
Classification: Unclassified
Component: Catalina (show other bugs)
Version: 8.5.3
Hardware: PC Linux
: P2 major (vote)
Target Milestone: ----
Assignee: Tomcat Developers Mailing List
URL:
Keywords:
: 61089 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-08-22 17:12 UTC by csyperski
Modified: 2020-11-23 05:58 UTC (History)
1 user (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description csyperski 2016-08-22 17:12:22 UTC
Tomcat: 8.5.3
OS: Ubuntu 16.04 (64-bit)
java version "1.8.0_101"
Java(TM) SE Runtime Environment (build 1.8.0_101-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.101-b13, mixed mode)


JSSE implementation that uses OpenSSL seems to have an issue where a request from Internet Explorer 8.x can cause a large portion of the CPU to be consumed until tomcat restart.  

Steps to replicate:

1.  On Ubuntu 16.04, download and extract 8.5.3.  
2.  Modify the conf/server.xml and add the following connector for SSL configuration:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" maxThreads="750" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeyFile="xxx.pem"
certificateFile="xxx.pem"
certificateChainFile="xxx.pem"
type="RSA" />
</SSLHostConfig>
</Connector>

3. Start tomcat and navigate using IE8 or IE8 on http://netrenderer.com/index.php to:
https://x.x.x.x:8443/manager/html
 

Result:
The CPU hangs at around 70%-100% on a single core until tomcat is started.  

Expected:
The page should be rendered without a high CPU load.  

This is worrying due to the ease of exploitation and large, persistent consumption of resources.  We have tested and replicated using Let's Encrypt and a GoDaddy wildcard ssl cert on multiple machines.  I would suspect this is due to a combination of older ciphers used on IE8.
Comment 1 Remy Maucherat 2016-08-23 16:32:52 UTC
I had missed the thread dump: http://pastebin.com/n9Rkybwv

This is not using OpenSSL actually, just plain JSSE with OpenSSL PEMs (thread names are "https-jsse-nio-8443-*", if it was using OpenSSL it would be "https-openssl-nio-8443-*").
Like Christopher, I don't see any problem thread that would be using CPU in the dump. Everything seems to be doing nothing and there are a few threads polling as they should.

So when you're using a keystore for your certificate, you're not running into this issue ?
Comment 2 csyperski 2016-08-23 16:51:17 UTC
I was able to reproduce this on multiple machines (all Ubuntu; all oracle Java 8) using 8.5.3 and I tried two certs and it always caused the high CPU consumption.  Yes, I had the same issue after converting to a keystore as well.  I tried the same exact setup on 8.0.36 and everything worked as expected.  For the time being, I've rolled back to 8.0.36, but would be more than happy to provide any additional information, as it is simple to replicate.
Comment 3 Mark Thomas 2016-08-24 10:27:14 UTC
This has been fixed in the following branches:
- 9.0.x for 9.0.0.M10 onwards
- 8.5.x for 8.5.5 onwards

8.0.x and earlier are not affected as they do not support SNI.
Comment 4 Remy Maucherat 2017-05-13 13:37:02 UTC
*** Bug 61089 has been marked as a duplicate of this bug. ***
Comment 5 rahel widaya 2020-10-21 03:58:11 UTC
1. Poker 88
Diusung sebelum hadirnya lawanqq. Poker 88 terbukti memiliki banyak member aktif semenjak awal peluncurannya. Hadir dengan 8 macam permainan kartu yang memanjakan anda, https://199.192.31.67 seakan menjadikan nafas baru yang dirasa bisa menjadi tambang yang baik untuk member menarik banyak keuntungan ketika bermain judi poker 88 online.
Di Dewabet anda bisa Bermain Aneka Permanan Khas server IDN Games yaitu;
•	Domino 99 Kiu Kiu,
•	Texas Hold’Em Poker,
•	Bandar QQ,
•	Bandar 66,
•	Capsa Susun,
•	Bandar Poker,
•	Bandar 66, dan
•	AduQ,
2. DEWATOGELONLINE88
Dewatogelonline88 Merupakan Situs togel online Terbaru di akhir tahun 2019. Situs Ini Berhasil Memperoleh banyak member dan memberikan banyak kemenangan sehingga di akreditasi terbaik oleh banyak situs referensi untuk dimainkan. http://www.dewatogelonline88.com/ merupakan Situs judi pkv terbaik dan yang menjajikan kemenangan bermain di situs nya hingga 98%, Angka yang begitu menjanjikan untuk kemenangan dalam permainan kartu online anda.
3. Pokerclub88
Pokerclub88 merupakan Agen Poker QQ Online Terbaik yang menyediakan semua jenis permainan kartu di main gamenya. Hadir dengan dengan segala kemudahan sebagai agen judi terpercaya, https://199.192.27.121  mengusung slogan mudah, murah dan aman.
•	Mudah
PokerAce bisa dimainkan kapan saja dimana pun selama ada jaringan internet, bahkan di android sekalipun
•	Murah
Dengan Minimal Deposit 25.000 saja anda sudah berkesempatan mendapatkan kemenangan hingga jutaan rupiah dan bisa bermain di semua permainan yang disediakan.
•	Aman
Permainan di PokerAce dijamin 100% fairplay.
4. Poker lounge
PokerLounge99 sebagai agen poker online indonesia terbesar dan terpercaya yang sudah lama menggunakan sistem keamanan terkini yang selalu di perbaharui dan dilengkapi dengan perangkat keras dan lunak yang canggih sehingga kenyamanan, keamanan dan rahasia data pribadi Anda aman bersama https://199.192.27.100. PokerLounge99 agen togel dan poker online dari indonesia yang terpercaya menggunakan uang asli dan menyediakan permainan live games.