huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unauthorized deletion of files
CVE: CVE-2023-49797
Component: pyinstaller
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2023-12-09T00:00:00+00:00

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-39495
Component: PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability
Release date: 2023-08-17T19:05:23.027000+00:00

PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the readFileIntoStream method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to disclose information in the context of the current user. Was ZDI-CAN-19657.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr
CVE: CVE-2023-3773
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-07-23T00:00:00+00:00

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
9pfs: improper access control on special files
CVE: CVE-2023-2861
Component: QEMU
CWE: CWE-284
Severity: Low
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2023-06-07T00:00:00+00:00

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.


Remediation:
CVE: CVE-2023-51574
Component: Voltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass Vulnerability
Release date: 2023-12-20T23:08:55.295000+00:00

Voltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the updateManagerPassword method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22010.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: ipset: Rework long task execution when adding/deleting entries
CVE: CVE-2023-53549
Component: kernel
CWE: CWE-1050
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

An uncontrolled resource consumption flaw was found in the Linux kernel's netfilter ipset subsystem when processing large batch operations. A local user with CAP_NET_ADMIN capability can trigger this issue by adding or deleting a large number of ipset entries in a single operation, causing the kernel to execute long-running tasks without yielding. This results in soft lockup conditions and denial of service through system unresponsiveness.

Statement: The ipset code processes batch add/delete operations in a tight loop while holding the nfnl mutex. When users specify a large range of IP addresses or ports to add to or remove from a set, the kernel can spend extended periods (potentially seconds) without scheduling, leading to soft lockup detector warnings and system unresponsiveness. Previous attempts to limit the batch size were insufficient—the limits were still too high to prevent hung task conditions on slower systems. Exploitation requires CAP_NET_ADMIN capability, which is typically restricted to root or containers with explicit network administration privileges.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Reflected XSS in /pipelines/artifacts/get
CVE: CVE-2023-6571
Component: kubeflow
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2023-12-14T00:00:00+00:00

A cross-site scripting (XSS) vulnerability was found in kubeflow's presentation of pipeline cards. This issue may allow an attacker to trick a user into visiting a specially crafted link that could inject malicious HTML into the victim's browser. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
nfc: pn533: initialize struct pn533_out_arg properly
CVE: CVE-2023-53119
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: initialize struct pn533_out_arg properly

struct pn533_out_arg used as a temporary context for out_urb is not
initialized properly. Its uninitialized 'phy' field can be dereferenced in
error cases inside pn533_out_complete() callback function. It causes the
following failure:

general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:pn533_out_complete.cold+0x15/0x44 drivers/nfc/pn533/usb.c:441
Call Trace:
 <IRQ>
 __usb_hcd_giveback_urb+0x2b6/0x5c0 drivers/usb/core/hcd.c:1671
 usb_hcd_giveback_urb+0x384/0x430 drivers/usb/core/hcd.c:1754
 dummy_timer+0x1203/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1da/0x800 kernel/time/timer.c:1700
 expire_timers+0x234/0x330 kernel/time/timer.c:1751
 __run_timers kernel/time/timer.c:2022 [inline]
 __run_timers kernel/time/timer.c:1995 [inline]
 run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
 __do_softirq+0x1fb/0xaf6 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107

Initialize the field with the pn533_usb_phy currently used.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.


Remediation:
misc: pci_endpoint_test: Free IRQs before removing the device
CVE: CVE-2023-54326
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's PCI endpoint test driver. In pci_endpoint_test_remove(), IRQs are freed after the device is removed, creating a race window where an IRQ can be delivered after device memory is freed. The IRQ handler then accesses invalid memory, causing a kernel crash.

Statement: This affects systems using the PCI endpoint test driver for PCIe endpoint testing. The race occurs during device hot-unplug or driver removal. Production systems typically do not use this test driver, limiting real-world exposure.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get
CVE: CVE-2023-6121
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2023-11-06T00:00:00+00:00

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
This flaw can be mitigated by explicitly setting the kernel parameter to restrict unprivileged users from using dmesg:
```
sudo sysctl -w kernel.dmesg_restrict=1
```
To make it persistent between system reboots:
```
echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.conf
```
UAF during login when accessing the shost ipaddress
CVE: CVE-2023-2162
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2023-01-17T10:30:00+00:00

A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
This flaw can be mitigated by preventing the affected iscsi_tcp.ko kernel module from loading during the boot time, ensure the module is added into the blacklist file.
~~~
Refer:  
How do I blacklist a kernel module to prevent it from loading automatically? 
https://access.redhat.com/solutions/41278
~~~
heap-based buffer overflow in ReadTIM2ImageData() function in coders/tim2.c
CVE: CVE-2023-34474
Component: ImageMagick
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-06-01T00:00:00+00:00

A heap-based buffer overflow issue was found in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. This flaw allows a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error, and allowing an application to crash, resulting in a denial of service.


Remediation:
mmc: mmc_spi: fix error handling in mmc_spi_probe()
CVE: CVE-2023-52708
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mmc: mmc_spi: fix error handling in mmc_spi_probe()

If mmc_add_host() fails, it doesn't need to call mmc_remove_host(),
or it will cause null-ptr-deref, because of deleting a not added
device in mmc_remove_host().

To fix this, goto label 'fail_glue_init', if mmc_add_host() fails,
and change the label 'fail_add_host' to 'fail_gpiod_request'.


Remediation:
CVE: CVE-2023-50220
Component: Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2023-01-01T00:00:00+00:00

Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Base64Element class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21801.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cmd/go: output does not sanitize values
CVE: CVE-2023-24531
Component: cmd/go
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2023-01-01T00:00:00+00:00

A vulnerability was found in Command Go. The environment does not sanitize the output values, allowing an attacker to run a shell script. This issue requires the malicious person to set arbitrary environment variables on a server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
CVE: CVE-2023-54263
Component: kernel
CWE: CWE-909
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's nouveau graphics driver for NVIDIA GPUs. The hpd_irq_lock spinlock is not initialized for PIOR (Parallel Interface Output Resource) DisplayPort connectors. This missing initialization causes a kernel oops on systems with ANX9805 DP encoders when hotplug detection operations access the uninitialized lock.

Statement: This issue affects a narrow subset of systems: those with NVIDIA graphics cards using the nouveau driver combined with ANX9805 DisplayPort encoder hardware. Most users will not encounter this bug as it requires specific external DP encoder hardware. The crash occurs during display hotplug events on affected systems.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the nouveau module from being loaded and use an alternative driver if available. See https://access.redhat.com/solutions/41278 for instructions.
Encrypted overlay network traffic may be unencrypted
CVE: CVE-2023-28841
Component: moby
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2023-04-04T00:00:00+00:00

A flaw was found in Moby due to missing encrypted sensitive data within the overlay network driver. This issue could allow a remote attacker to obtain sensitive information by sending a specially crafted request and use this information to launch further attacks against the affected system.

Statement: This CVE affects the 'github.com/moby/moby/libnetwork/drivers/overlay' codebase which is only shipped in Fedora community products and not in any of the Red Hat products. Therefore, Red Hat products are marked as Not Affected.

Remediation:
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html/clusters/cluster_mce_overview#installing-while-connected-online-mce
ReDoS via untrusted URLs
CVE: CVE-2023-32758
Component: python-git-url-parse
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-04-25T00:00:00+00:00

giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling
CVE: CVE-2023-54074
Component: kernel
CWE: CWE-704
Severity: Moderate
CVSS v3: 3.7/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the mlx5e Traffic Control (TC) encapsulation logic in the net/mlx5e driver of the Linux kernel. The code responsible for invalidating encapsulation actions did not use the proper helper function to retrieve the correct encapsulation attribute, instead assuming the default attribute would suffice. When the post-action infrastructure was introduced, most users of the encap attribute were updated to call mlx5e_tc_get_encap_attr() to obtain the correct attribute; however, the invalidation path in mlx5e_invalidate_encap() was not updated accordingly. This could result in improper destruction of header modify actions and generate WARNINGS in the kernel log.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
CVE: CVE-2023-45235
Component: edk2
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the disclosure of information and potential compromise of system availability.

Statement: The discovery of a buffer overflow vulnerability in EDK2, the open-source implementation of the UEFI specification, raises significant concerns for system security. This flaw, when exploited by an unauthorized attacker on the same network, allows for the transmission of a malicious DHCPv6 proxy Advertise message. This can lead to the compromise of sensitive information and poses a serious threat to the availability of the system.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.