huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Use after free in UI
CVE: CVE-2024-9957
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-10-15T00:00:00+00:00

Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Write-what-where in rpc_server::set_tensor
CVE: CVE-2024-42479
Component: llama-cpp
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2024-08-12T00:00:00+00:00

llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Fail to Escape Arguments Properly in Microsoft Windows
CVE: CVE-2024-27980
Component: Node.js
CWE: CWE-78
Severity: None
Release date: 2024-04-09T00:00:00+00:00

A command injection flaw was found in Node.js exclusive to Windows environments. This flaw allows an attacker to perform command injection via the args parameter of child_process.spawn without the shell option enabled on Windows. This behavior is caused by cmd.exe when executing batch files, which has complicated parsing rules for arguments that were not able to be safely escaped. It is possible to inject commands if an attacker can control part of the command arguments of the batch file.

Statement: This vulnerability exclusively applies to applications running on Windows.

Remediation:
smb: Fix regression in writes when non-standard maximum write size negotiated
CVE: CVE-2024-26692
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2024-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: Fix regression in writes when non-standard maximum write size negotiated

The conversion to netfs in the 6.3 kernel caused a regression when
maximum write size is set by the server to an unexpected value which is
not a multiple of 4096 (similarly if the user overrides the maximum
write size by setting mount parm "wsize", but sets it to a value that
is not a multiple of 4096).  When negotiated write size is not a
multiple of 4096 the netfs code can skip the end of the final
page when doing large sequential writes, causing data corruption.

This section of code is being rewritten/removed due to a large
netfs change, but until that point (ie for the 6.3 kernel until now)
we can not support non-standard maximum write sizes.

Add a warning if a user specifies a wsize on mount that is not
a multiple of 4096 (and round down), also add a change where we
round down the maximum write size if the server negotiates a value
that is not a multiple of 4096 (we also have to check to make sure that
we do not round it down to zero).


Remediation:
InnoDB unspecified vulnerability (CPU Jul 2024)
CVE: CVE-2024-21157
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-16T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.36 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Potential Heap Overflow Vulnerability for AArch64
CVE: CVE-2024-25817
Component: rust-eza
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-03-06T00:00:00+00:00

Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller
CVE: CVE-2024-26738
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel, occurring during the Dynamic Logical Partitioning (DLPAR) add of a PCI device. The iommu_device structure is not properly initialized and this leads to a NULL pointer dereference which can cause kernel crashes.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Remediation:
Improper Input Validation
CVE: CVE-2024-21507
Component: mysql2
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2024-04-10T00:00:00+00:00

A flaw was found in the MySQL2 npm package. Affected versions of this package are vulnerable to improper input validation through the keyFromFields function, resulting in cache poisoning. This flaw allows an attacker to inject a colon (:) character within a value of the attacker-crafted key.

Statement: The Red Hat Developer Hub remains unaffected by this vulnerability since it does not include the vulnerable codebase or version.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
OS Command Execution due to Insecure Environment Variable Handling
CVE: CVE-2024-42029
Component: xdg-desktop-portal-hyprland
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-07-27T04:20:00+00:00

An OS command injection vulnerability was found in xdg-desktop-portal-hyprland. This flaw allows attackers to execute arbitrary OS commands by manipulating input sent to the App ID Handler component. The vulnerability can be exploited by anyone who can send crafted input to the component, making it easily exploitable. Attackers can leverage this flaw to execute commands that may alter or delete system files, access sensitive data, or disrupt system operations.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-buffer-overflow in OpenDDLParser::parseStructure
CVE: CVE-2024-48424
Component: assimp
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-24T00:00:00+00:00

A flaw was found in the Assimp asset import library. An attacker my be able to trigger a buffer overflow condition via specially-crafted OpenGEX files. This may lead to a denial of service or other unexpected behavior.

Statement: The heap-buffer-overflow vulnerability in the Assimp library is classified as moderate because, while it can cause memory corruption or application crashes, it does not inherently lead to arbitrary code execution or privilege escalation. Exploitation requires a crafted OpenGEX file, limiting the attack surface to scenarios where untrusted files are processed by the affected function.

It's important to note that this vulnerability does not impact any Red Hat products, indicating that Red Hat's software stack is unaffected by this specific CVE.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improper initialization in UEFI firmware OutOfBandXML module
CVE: CVE-2024-31157
Component: microcode_ctl
CWE: CWE-665
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Release date: 2024-01-01T00:00:00+00:00

Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.


Remediation:
drm/i915: Grab intel_display from the encoder to avoid potential oopsies
CVE: CVE-2024-58074
Component: kernel
CWE: CWE-665
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Grab intel_display from the encoder to avoid potential oopsies

Grab the intel_display from 'encoder' rather than 'state'
in the encoder hooks to avoid the massive footgun that is
intel_sanitize_encoder(), which passes NULL as the 'state'
argument to encoder .disable() and .post_disable().

TODO: figure out how to actually fix intel_sanitize_encoder()...


Remediation:
Database activity issue in separate groups mode, for users not in a group
CVE: CVE-2024-55646
Component: moodle
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2024-12-17T00:00:00+00:00

A flaw has been identified in Moodle where, in a database activity with separate groups mode enabled, users not assigned to any group (and lacking permissions to access all groups) could view entries from all groups instead of being restricted to entries from other ungrouped users. An attacker could exploit this by creating or accessing an ungrouped user account to bypass group-based restrictions, potentially gaining unauthorized access to sensitive information shared within groups.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ext4: fix access to uninitialised lock in fc replay path
CVE: CVE-2024-50014
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix access to uninitialised lock in fc replay path

The following kernel trace can be triggered with fstest generic/629 when
executed against a filesystem with fast-commit feature enabled:

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x66/0x90
 register_lock_class+0x759/0x7d0
 __lock_acquire+0x85/0x2630
 ? __find_get_block+0xb4/0x380
 lock_acquire+0xd1/0x2d0
 ? __ext4_journal_get_write_access+0xd5/0x160
 _raw_spin_lock+0x33/0x40
 ? __ext4_journal_get_write_access+0xd5/0x160
 __ext4_journal_get_write_access+0xd5/0x160
 ext4_reserve_inode_write+0x61/0xb0
 __ext4_mark_inode_dirty+0x79/0x270
 ? ext4_ext_replay_set_iblocks+0x2f8/0x450
 ext4_ext_replay_set_iblocks+0x330/0x450
 ext4_fc_replay+0x14c8/0x1540
 ? jread+0x88/0x2e0
 ? rcu_is_watching+0x11/0x40
 do_one_pass+0x447/0xd00
 jbd2_journal_recover+0x139/0x1b0
 jbd2_journal_load+0x96/0x390
 ext4_load_and_init_journal+0x253/0xd40
 ext4_fill_super+0x2cc6/0x3180
...

In the replay path there's an attempt to lock sbi->s_bdev_wb_lock in
function ext4_check_bdev_write_error().  Unfortunately, at this point this
spinlock has not been initialized yet.  Moving it's initialization to an
earlier point in __ext4_fill_super() fixes this splat.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
memblock: make memblock_set_node() also warn about use of MAX_NUMNODES
CVE: CVE-2024-40917
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A flaw was found in `memblock_set_node()` in the Linux Kernel, where invalid NUMA node values exceeding `MAX_NUMNODES` could cause system crashes due to a NULL pointer dereference.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
improper authorization for namespace and topic management endpoints
CVE: CVE-2024-29834
Component: apache-pulsar
CWE: CWE-285
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2024-04-02T00:00:00+00:00

A flaw was discovered in Apache Pulsar. This issue may allow an authenticated user with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. Additionally, the authenticated user could read, create, modify, and delete namespace properties in any namespace and tenant.

Statement: This vulnerability in Apache Pulsar, rated as important severity, poses a notable risk due to its potential to compromise the integrity and security of partitioned topics and namespace properties. Authenticated users with produce or consume permissions can execute unauthorized actions such as unloading topics, triggering compaction, and modifying namespace properties, typically reserved for higher privileged roles. This deviation from intended access control mechanisms introduces the risk of data manipulation, unauthorized access, and potential disruption of system functionality. While the impact is significant, the severity is important by the requirement for authenticated access and specific permissions.

Apache Pulsar is not part of EAP - it's not present in the EAP dependency tree and not distributed in the product maven repository. EAP is not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
CVE: CVE-2024-35817
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag

The Linux kernel CVE team has assigned CVE-2024-35817 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051743-CVE-2024-35817-d29b@gregkh/T


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Use after free in Dawn
CVE: CVE-2024-5831
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-06-11T00:00:00+00:00

Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/ast: Fix soft lockup
CVE: CVE-2024-35952
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-20T00:00:00+00:00

CVE-2024-35952 describes an issue in the Linux kernel's AST graphics driver. The problem occurs in the ast_dp_set_on_off() function, where a lack of proper synchronization with the DisplayPort Microcontroller Unit (DPMCU) can result in an infinite loop. This can cause a "soft lockup" in the host system, impacting its availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
smb: client: fix OOBs when building SMB2_IOCTL request
CVE: CVE-2024-50151
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-07T00:00:00+00:00

A flaw was found in the cifs module in the Linux kernel. When building SMB2_IOCTL requests using encryption, either enforced by the server or using the 'seal' mount option, an out-of-bounds write can be triggered when the user passes an input buffer greater than 328 bytes, resulting in memory corruption and a kernel crash.

Statement: To exploit this flaw, an attacker needs local access to the system and SMB encryption must be enabled, limiting the impact of this issue. For these reasons, this flaw has been rated with a moderate severity.

The cifs module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of the Linux kernel.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Consider temporarily disabling SMB encryption and monitor the system for unusual behavior, such as crashes, as it may indicate exploitation attempts.
DoS by null pointer in websocket over HTTP/2
CVE: CVE-2024-36387
Component: mod_http2
CWE: CWE-476
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-07-01T00:00:00+00:00

A flaw was found in the Apache HTTP Server. Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a NULL pointer dereference, leading to a crash of the server process.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HTTP/2 client improper reverse DNS lookup (8315708)
CVE: CVE-2024-21012
Component: OpenJDK
CWE: CWE-350
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2024-04-16T20:00:00+00:00

A flaw was found in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
bind9: A flood of DNS messages over TCP may make the server unstable
CVE: CVE-2024-0760
Component: bind
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-23T00:00:00+00:00

A flaw was found in the bind9 package, where a malicious client may send many DNS messages over the TCP protocol, leading to instabilities on the server side and potentially causing a denial of service. The server will recover automatically once the attack ceases.

Statement: This vulnerability does not affect the bind and dhcp versions as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9. The bind versions vulnerable to this flaw are 9.18.1 to 9.18.27 and 9.19.0 to 9.19.24, while the most recent bind version in Red Hat Enterprise Linux 9 is bind-9.16.26-11.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
blk-cgroup: fix list corruption from resetting io stat
CVE: CVE-2024-38663
Component: kernel
CWE: CWE-665
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from resetting io stat

Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"),
each iostat instance is added to blkcg percpu list, so blkcg_reset_stats()
can't reset the stat instance by memset(), otherwise the llist may be
corrupted.

Fix the issue by only resetting the counter part.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.