huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
HID: multitouch: Add NULL check in mt_input_configured
CVE: CVE-2024-58020
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Add NULL check in mt_input_configured

devm_kasprintf() can return a NULL pointer on failure,but this
returned value in mt_input_configured() is not checked.
Add NULL check in mt_input_configured(), to handle kernel NULL
pointer dereference error.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
blk-iocost: avoid out of bounds shift
CVE: CVE-2024-36916
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-iocost: avoid out of bounds shift

UBSAN catches undefined behavior in blk-iocost, where sometimes
iocg->delay is shifted right by a number that is too large,
resulting in undefined behavior on some architectures.

[  186.556576] ------------[ cut here ]------------
UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23
shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')
CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S          E    N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1
Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020
Call Trace:
 <IRQ>
 dump_stack_lvl+0x8f/0xe0
 __ubsan_handle_shift_out_of_bounds+0x22c/0x280
 iocg_kick_delay+0x30b/0x310
 ioc_timer_fn+0x2fb/0x1f80
 __run_timer_base+0x1b6/0x250
...

Avoid that undefined behavior by simply taking the
"delay = 0" branch if the shift is too large.

I am not sure what the symptoms of an undefined value
delay will be, but I suspect it could be more than a
little annoying to debug.


Remediation:
scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages
CVE: CVE-2024-43816
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages

On big endian architectures, it is possible to run into a memory out of
bounds pointer dereference when FCP targets are zoned.

In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is
referencing a little endian formatted sgl->sge_len value.  So, the memcpy
can cause big endian systems to crash.

Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are
referring to a little endian formatted data structure.  And, update the
routine with proper le32_to_cpu macro usages.


Remediation:
drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
CVE: CVE-2024-53115
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle

The 'vmw_user_object_buffer' function may return NULL with incorrect
inputs. To avoid possible null pointer dereference, add a check whether
the 'bo' is NULL in the vmw_framebuffer_surface_create_handle.


Remediation:
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
CVE: CVE-2024-56747
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2024-12-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()

Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA
memory sb_virt when it fails. Add dma_free_coherent() to free it. This
is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().


Remediation:
infinispan: REST compare API has buffer leak
CVE: CVE-2024-6875
Component: infinispan
CWE: CWE-401
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.

Statement: The REST endpoint is secured (= authentication is required) by default
in RHDG, so it is not possible for an anonymous attacker to utilize this issue.

Remediation:
Server: Options unspecified vulnerability (CPU Jan 2024)
CVE: CVE-2024-20968
Component: mysql
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-16T00:00:00+00:00

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
integer overflow in dissect_bgp_open() in epan/dissectors/packet-bgp.c
CVE: CVE-2024-24478
Component: wireshark
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-02-21T00:00:00+00:00

A flaw was found in Wireshark. This issue allows a remote attacker to trigger an integer overflow in the dissect_bgp_open function in the epan/dissectors/packet-bgp.c file, resulting in a denial of service.

Statement: The Wireshark package as shipped in Red Hat Enterprise Linux 6, 7, 8 and 9 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of Wireshark.

Remediation:
keycloak-quarkus-server: Unrestricted admin use of system and environment variables
CVE: CVE-2024-11736
Component: org.keycloak
CWE: CWE-526
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-01-01T00:00:00+00:00

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

Statement: Red Hat has evaluated this vulnerability and it only affects Keycloak. This should not affect any connector or adapter.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
debugfs: fix wait/cancellation handling during remove
CVE: CVE-2024-35793
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-17T00:00:00+00:00

A flaw was found in the debugfs module in the Linux kernel. A deadlock can be triggered when files are removed and accessed, resulting in a denial of service.

Statement: The debugfs module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and 9 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of the Linux kernel.

Remediation:
ppdev: Add an error check in register_device
CVE: CVE-2024-36015
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ppdev: Add an error check in register_device

In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.

To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
CVE: CVE-2024-41128
Component: rubygem-actionpack
CWE: CWE-1333
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-10-15T23:35:33+00:00

A flaw was found in rubygem actionpack. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a denial of service.

Statement: Users on Ruby 3.2 are unaffected by this issue.

Remediation:
Revert &#34;drm/amd: flush any delayed gfxoff on suspend entry&#34;
CVE: CVE-2024-26916
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/amd: flush any delayed gfxoff on suspend entry"

commit ab4750332dbe ("drm/amdgpu/sdma5.2: add begin/end_use ring
callbacks") caused GFXOFF control to be used more heavily and the
codepath that was removed from commit 0dee72639533 ("drm/amd: flush any
delayed gfxoff on suspend entry") now can be exercised at suspend again.

Users report that by using GNOME to suspend the lockscreen trigger will
cause SDMA traffic and the system can deadlock.

This reverts commit 0dee726395333fea833eaaf838bc80962df886c8.


Remediation:
memory leak
CVE: CVE-2024-25269
Component: libheif
Release date: 2024-03-05T00:00:00+00:00

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mishandling of an unbalanced comment string in json-lib
CVE: CVE-2024-47855
Component: json-lib
CWE: CWE-1286
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-10-04T00:00:00+00:00

A flaw was found in JSON-lib's JSONTokener component. This vulnerability allows a denial of service via an unbalanced comment string.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
cluster-manager permissions may allow a worker node to obtain service account tokens
CVE: CVE-2024-9779
Component: open-cluster-management-io/ocm
CWE: CWE-266
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.

Statement: This flaw affects upstream Open Cluster Management version 0.12.0 and was fixed in 0.13.0. No supported versions of Red Hat Advanced Cluster Management are affected.

Remediation:
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
CVE: CVE-2024-46747
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
nvme-fabrics: use reserved tag for reg read/write command
CVE: CVE-2024-41082
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-fabrics: use reserved tag for reg read/write command

In some scenarios, if too many commands are issued by nvme command in
the same time by user tasks, this may exhaust all tags of admin_q. If
a reset (nvme reset or IO timeout) occurs before these commands finish,
reconnect routine may fail to update nvme regs due to insufficient tags,
which will cause kernel hang forever. In order to workaround this issue,
maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved
tags. This maybe safe for nvmf:

1. For the disable ctrl path,  we will not issue connect command
2. For the enable ctrl / fw activate path, since connect and reg_xx()
   are called serially.

So the reserved tags may still be enough while reg_xx() use reserved tags.

Statement: Following issue marked as moderate with "not affected or will not fix" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes
CVE: CVE-2024-3374
Component: mongodb
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-05-14T00:00:00+00:00

A flaw was found in MongoDB. This flaw allows an unauthenticated user to trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.


Remediation:
igc: avoid returning frame twice in XDP_REDIRECT
CVE: CVE-2024-26853
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-17T00:00:00+00:00

A memory corruption flaw was found in the Linux kernel’s Intel(R) Ethernet Controller I225-LM/I225-V driver in how a user generates a high amount of packets. This flaw allows a local user to crash the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
path traversal through symlinks
CVE: CVE-2024-26150
Component: backstage/backend-common
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.3/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Release date: 2024-02-23T00:00:00+00:00

A flaw was found in the backstage/backend-common package. Path checks with the "resolveSafeChildPath" utility were not exhaustive enough, leading to the risk of a path traversal vulnerability if symlinks are injected by attackers.

Statement: RHDH actions do not use symlinks and would not be exposed.  There is a small chance that customers can use 3rd party software templates that use symlinks but it's a low risk and to our knowledge, none of our customers are going into production with 1.0.  If they had intentions to, we would advise them to use 1.1 which is patched already.

Since 1.0 is in maintenance mode, our decision is aligned with our lifecycle policy to only backport critical and important CVEs.  So marking as would not fix.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
improper digital signature invalidation vulnerability
CVE: CVE-2024-7788
Component: libreoffice
CWE: CWE-347
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-09-17T15:15:14.413000+00:00

A flaw was found in LibreOffice. Various file formats are based on the zip file format. In cases of corruption of the underlying zip's central directory, LibreOffice offers a "repair mode" which will attempt to recover the zip file structure by scanning for secondary local file headers in the zip to reconstruct the document. In the case of digitally signed zip files, an attacker could construct a document which, when repaired, reported a signature status not valid for the recovered file.

Statement: The issue of incorrect digital signature validation during the repair of corrupted zip files in LibreOffice is classified as moderate severity due to its specific conditions and limited impact. While the flaw could potentially allow an attacker to exploit the repair mechanism to bypass signature verification, it requires both the corruption of a zip file and the presence of a digital signature, which narrows the scope of exploitation. Furthermore, successful exploitation would only affect the validation of the signature status rather than directly compromising the integrity or security of the document's content.

Remediation:
Do not try to recover or open an untrusted document.
drm/i915/hdcp: Add encoder check in hdcp2_get_capability
CVE: CVE-2024-53050
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: Add encoder check in hdcp2_get_capability

Add encoder check in intel_hdcp2_get_capability to avoid
null pointer error.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Ucum-java has an XXE vulnerability in XML parsing
CVE: CVE-2024-55887
Component: ucum
CWE: CWE-611
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2024-12-13T16:08:55.658000+00:00

A flaw was found in the ucum-java library for FHIR. XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used within a host where external clients can submit XML.

Statement: The FHIR component is not supported in Red Hat Fuse 7 and Red Hat Integration Camel K, so these products are not affected by this vulnerability.

This vulnerability is of important severity because it enables XML External Entity (XXE) injection, a important issue that can lead to unauthorized access to sensitive data and system compromise. By exploiting improperly configured XML parsers, an attacker can craft malicious XML containing external entities or DTD references to read arbitrary files on the server, such as `/etc/passwd` or configuration files, potentially exposing credentials or system secrets. Additionally, XXE can facilitate Server-Side Request Forgery (SSRF), allowing attackers to interact with internal systems or services, leading to further lateral movement. Given that the affected `UcumEssenceService` may process externally submitted XML files, the exposure surface is significant, especially in environments where user input cannot be fully trusted.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
CVE: CVE-2024-56602
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

A user-after-free vulnerability was found in the linux kernel. sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, leading to a crash and loss of availability of the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.