IJ26670: JVM MEMORY GROWTH CAN BE CAUSED BY THE IBMPKCS11IMPL CRYPTO PROVIDER

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: N/A
  .
  

Local fix

Problem summary

• JVM memory growth can be caused by the IBMPKCS11Impl crypto
  provider.
  

Problem conclusion

• Not all hardware sessions associated with PKCS#11 keys
  (specifically keys with the CKA_TOKEN attribute set to false)
  are being closed after the PKCS#11 key or key pair is
  de-referenced and cleaned up.  Memory growth occurs as the
  un-closed hardware sessions accumulate. Updates have been made
  to the IBMPKCS11Impl provider to ensure that the hardware
  session associated with these keys is always successfully closed
  after the key or key pair is de-referenced and cleaned up.
  The jar affected by this apar is  ibmpkcs11impl.jar.
  The associated Hursley RTC Problem Report is 143977.
  The associated Austin Git issue is Issue#8 for IBMPKCS11Impl.
  The associated Austin APAR is IJ23371.
  JVMs affected include: Java 7.0, 7.1, and 8.0.
  The fix was delivered for Java 7.0 sr10 fp75, Java 7.1 sr4 fp75,
  and Java 8.0 sr6 fp25.
  The build level of the ibmpkcs11impl.jar delivered for Java 7.0
  and 7.1 is build-101.
  
  .
  This APAR will be fixed in the following Java Releases:
     7    SR10 FP75 (7.0.10.75)
     7 R1 SR4 FP75  (7.1.4.75)
     8    SR6 FP25  (8.0.6.25)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels