deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-26131
Published: 2024-02-29
Description: Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-923, CWE-940
References: https://element.io/blog/security-release-element-android-1-6-12; https://github.com/element-hq/element-android/commit/53734255ec270b[PII_REDACTED]787393dfcaa2a5a9; https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm
CVE: CVE-2024-26132
Published: 2024-02-29
Description: Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token. Forks of Element Android which have set `android:exported="false"` in the `AndroidManifest.xml` file for the `IncomingShareActivity` activity are not impacted. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://element.io/blog/security-release-element-android-1-6-12; https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07; https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4
CVE: CVE-2024-26458
Published: 2024-02-29
Description: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md
CVE: CVE-2024-26461
Published: 2024-02-29
Description: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md
CVE: CVE-2024-26462
Published: 2024-02-29
Description: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md
CVE: CVE-2024-26470
Published: 2024-02-29
Description: A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470; https://github.com/fullstackhero/dotnet-webapi-boilerplate; https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate
CVE: CVE-2024-26471
Published: 2024-02-29
Description: A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web browser of a victim via the search parameter in offer.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26471; https://github.com/zhimengzhe/iBarn; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26471
CVE: CVE-2024-26472
Published: 2024-02-29
Description: KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may allow remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' or 'validator' parameters of 'create-new-pwd.php'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26472; https://github.com/msaad1999/KLiK-SocialMediaWebsite/; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26472
CVE: CVE-2024-26473
Published: 2024-02-29
Description: A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the web browser of a victim via the poll parameter in poll.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26473; https://github.com/msaad1999/KLiK-SocialMediaWebsite/; https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26473
CVE: CVE-2024-27083
Published: 2024-02-29
Description: Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84; https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
CVE: CVE-2024-27092
Published: 2024-02-29
Description: Hoppscotch is an API development ecosystem.  Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors.  This issue is fixed in 2023.12.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79, CWE-79
References: https://github.com/hoppscotch/hoppscotch/blob/main/packages/hoppscotch-backend/src/team-invitation/team-invitation.service.ts#L153; https://github.com/hoppscotch/hoppscotch/commit/6827e97ec583b2534cdc1c2f33fa44973a0c2bf5; https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-8r6h-8r68-q3pp
CVE: CVE-2024-27284
Published: 2024-02-29
Description: cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour.  The problem has been fixed in version 3.0.0.

CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7; https://github.com/Metaswitch/cassandra-rs/security/advisories/GHSA-x9xc-63hg-vcfq; https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7
CVE: CVE-2024-27516
Published: 2024-02-29
Description: Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab; https://github.com/LiveHelperChat/livehelperchat/issues/2054; https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab
CVE: CVE-2024-27517
Published: 2024-02-29
Description: Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/webasyst/webasyst-framework/issues/377; https://github.com/webasyst/webasyst-framework/issues/377
CVE: CVE-2023-27545
Published: 2024-02-29
Description: IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system.  IBM X-Force ID:  248947.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248947; https://www.ibm.com/support/pages/node/6965446; https://exchange.xforce.ibmcloud.com/vulnerabilities/248947
CVE: CVE-2023-38367
Published: 2024-02-29
Description: IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration.  IBM X-Force ID:  261130.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261130; https://www.ibm.com/support/pages/node/7015271; https://exchange.xforce.ibmcloud.com/vulnerabilities/261130
CVE: CVE-2023-51800
Published: 2024-02-29
Description: Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the main_settings component in the phone, address, bank, acc_name, acc_number parameters, new_class and cname parameter, add_new_parent function in the name email parameters, new_term function in the tname parameter, and the edit_student function in the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-51800; https://github.com/geraldoalcantara/CVE-2023-51800
CVE: CVE-2023-51801
Published: 2024-02-29
Description: SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the student_form.php and the class_form.php pages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/geraldoalcantara/CVE-2023-51801; https://github.com/geraldoalcantara/CVE-2023-51801
CVE: CVE-2023-51802
Published: 2024-02-29
Description: Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the page or class_month parameter in the /php-attendance/attendance_report component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-51802; https://github.com/geraldoalcantara/CVE-2023-51802
CVE: CVE-2024-22871
Published: 2024-02-29
Description: An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://hackmd.io/%40fe1w0/rymmJGida; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV/
CVE: CVE-2021-39090
Published: 2024-02-29
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  216388.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216388; https://www.ibm.com/support/pages/node/6856407; https://exchange.xforce.ibmcloud.com/vulnerabilities/216388
CVE: CVE-2024-0689
Published: 2024-02-29
Description: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the meta values. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042177%40custom-field-suite&new=3042177%40custom-field-suite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e967ce-fd36-44de-acca-c1985642ee5b?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042177%40custom-field-suite&new=3042177%40custom-field-suite&sfp_email=&sfph_mail=
CVE: CVE-2024-1468
Published: 2024-02-29
Description: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://avada.com/documentation/avada-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cde6e758-9723-43f2-9972-32be8aeb2b91?source=cve; https://avada.com/documentation/avada-changelog/
CVE: CVE-2023-51528
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gpt3-ai-content-generator/wordpress-ai-power-complete-ai-pack-powered-by-gpt-4-plugin-1-8-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gpt3-ai-content-generator/wordpress-ai-power-complete-ai-pack-powered-by-gpt-4-plugin-1-8-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51529
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor.This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ht-mega-for-elementor/wordpress-ht-mega-absolute-addons-for-elementor-plugin-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ht-mega-for-elementor/wordpress-ht-mega-absolute-addons-for-elementor-plugin-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51530
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gs-logo-slider/wordpress-logo-slider-plugin-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gs-logo-slider/wordpress-logo-slider-plugin-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51531
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Automator.This issue affects Thrive Automator: from n/a through 1.17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/thrive-automator/wordpress-thrive-automator-plugin-1-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/thrive-automator/wordpress-thrive-automator-plugin-1-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51696
Published: 2024-02-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cleantalk-spam-protect/wordpress-spam-protection-antispam-firewall-by-cleantalk-anti-spam-plugin-6-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cleantalk-spam-protect/wordpress-spam-protection-antispam-firewall-by-cleantalk-anti-spam-plugin-6-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-1341
Published: 2024-02-29
Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS files from external sources through the additional_js attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042304%40advanced-iframe&new=3042304%40advanced-iframe&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/699e5c80-8a11-4f67-8b17-41170d9c6411?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042304%40advanced-iframe&new=3042304%40advanced-iframe&sfp_email=&sfph_mail=
CVE: CVE-2024-1435
Published: 2024-02-29
Description: Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/tainacan/vulnerability/wordpress-tainacan-plugin-0-20-6-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tainacan/wordpress-tainacan-plugin-0-20-6-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-1841
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. 

Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability.  This version and all later versions
correct the reported vulnerability.


CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices; https://https://www.honeywell.com/us/en/product-security; https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices
CVE: CVE-2023-47874
Published: 2024-02-29
Description: Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/perfmatters/wordpress-perfmatters-plugin-2-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-50905
Published: 2024-02-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-security-audit-log/wordpress-wp-activity-log-plugin-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-security-audit-log/wordpress-wp-activity-log-plugin-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52475
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2efe67c581a2a6122b328d4bb6f21b3f36f40d46; https://git.kernel.org/stable/c/5aa514100aaf59868d[PII_REDACTED]69a16737c7bd; https://git.kernel.org/stable/c/5c15c60e7be615f05a45cd905093a54b11f461bc
CVE: CVE-2023-52476
Published: 2024-02-29
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/x86/lbr: Filter vsyscall addresses

We found that a panic can occur when a vsyscall is made while LBR sampling
is active. If the vsyscall is interrupted (NMI) for perf sampling, this
call sequence can occur (most recent at top):

    __insn_get_emulate_prefix()
    insn_get_emulate_prefix()
    insn_get_prefixes()
    insn_get_opcode()
    decode_branch_type()
    get_branch_type()
    intel_pmu_lbr_filter()
    intel_pmu_handle_irq()
    perf_event_nmi_handler()

Within __insn_get_emulate_prefix() at frame 0, a macro is called:

    peek_nbyte_next(insn_byte_t, insn, i)

Within this macro, this dereference occurs:

    (insn)->next_byte

Inspecting registers at this point, the value of the next_byte field is the
address of the vsyscall made, for example the location of the vsyscall
version of gettimeofday() at 0xffffffffff600000. The access to an address
in the vsyscall region will trigger an oops due to an unhandled page fault.

To fix the bug, filtering for vsyscalls can be done when
determining the branch type. This patch will return
a "none" branch if a kernel address if found to lie in the
vsyscall region.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]652488a50f00e96de4331e5efabc6c; https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265; https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db