qingtengyun/cve-2021-44228-qingteng-patchHotpatch tool for CVE-2021-44228 (Log4Shell) that uses JVM Instrumentation API to fix JndiLookup::lookup() in running Java processes without restart. Supports JDK 6–11 and Windows.
https://github.com/qingtengyun/cve-2021-44228-qingteng-patch
Fixes CVE-2021-44228 for log4j2, using the Instrumentation API provided by the JVM to modify existing bytecode loaded into the JVM.
Without restarting the Java process, it modifies the lookup method of org.apache.logging.log4j.core.lookup.JndiLookup class to always return
Patched JndiLookup::lookup().
Simply referenced https://github.com/corretto/hotpatch-for-apache-log4j2 for modifications and enhancements, supports JDK versions 6, 7, 8, 9, 10, 11, supports Windows.
jattach and jattach.exe come from https://github.com/apangin/jattach, you can compare with GitHub.
If you are not confident about the downloaded built tool, you can download the source code and execute build.sh to repackage.
The build.sh output is located in the build/cve-2021-44228-qingteng-patch directory.
Linux:
./attach.sh $pid
./attach.sh
./attach.sh without pid will use jps to list all Java processes on this machine, then enter the line number to select a process for injection and repair. Entering all will inject all listed Java processes.
Multiple inputs are allowed, separated by spaces.
Windows:
Double-click attach.bat, then enter the Java process pid.
Or pass the pid on the cmd command line, e.g., attach.bat pid
$ ./attach.sh 438625
/data/qingteng/cve-2021-44228-qingteng-patch
will patch pid: 438625
/data/qingteng/cve-2021-44228-qingteng-patch/jattach 438625 load instrument false /data/qingteng/cve-2021-44228-qingteng-patch/qt-log4j-agent.jar=/data/qingteng/cve-2021-44228-qingteng-patch/qt-log4j-patch.jar
Connected to remote JVM
JVM response code = 0
0
The output ending with
JVM response code = 0
0
indicates successful injection. Otherwise, it fails.
Could not start attach mechanism: No such file or directory
Possible causes:
The VM was started with the -XX:+DisableAttachMechanism parameter, meaning Attach has been disabled.
The /tmp/.java_pid$pid socket file was created and then deleted, making Attach impossible – this method cannot be used.
You need to be the same user as the Java process. If the running user is not allowed to log in, you can use root to execute su, paying attention to replace pid_username and pid
su -l -s /bin/bash -c "$(pwd)/attach.sh pid" pid_username