huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service in uprobes due to improper instruction validation
CVE: CVE-2025-38466
Component: kernel
CWE: CWE-266
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf: Revert to requiring CAP_SYS_ADMIN for uprobes

Jann reports that uprobes can be used destructively when used in the
middle of an instruction. The kernel only verifies there is a valid
instruction at the requested offset, but due to variable instruction
length cannot determine if this is an instruction as seen by the
intended execution stream.

Additionally, Mark Rutland notes that on architectures that mix data
in the text segment (like arm64), a similar things can be done if the
data word is 'mistaken' for an instruction.

As such, require CAP_SYS_ADMIN for uprobes.


Remediation:
Excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container
CVE: CVE-2025-8766
Component: noobaa-core
CWE: CWE-276
Severity: Important
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container

Statement: Red Hat Product Security has rated this vulnerability as moderate severity for affected products which run on OpenShift. The vulnerability allows for potential privilege escalation within a container, but OpenShift's default, multi-layered security posture effectively mitigates this risk.

The primary controls include the default Security Context Constraints (SCC), which severely limit a container's permissions from the start, and SELinux, which enforces mandatory access control to ensure strict isolation. While other container runtime environments may have different controls available and require case-by-case analysis, OpenShift's built-in defenses are designed to prevent this type of attack.

Out of Box RHEL configuration isolates a single process inside a container. Unless multiple processes are packaged inside a single container, that defeats the principle behind containerization, this bug can not be used to meaningfully escalate privileges.

Also, RHEL, and any common linux distributions do NOT add any additional users to the root group. The presence of the root group is strictly due to conformance with POSIX permission management requirements and can be considered to be an artifact of filesystem permission limitations.

Remediation:
Linux kernel: Denial of Service due to null pointer dereference in GT MMIO initialization for VFs
CVE: CVE-2025-38036
Component: kernel
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vf: Perform early GT MMIO initialization to read GMDID

VFs need to communicate with the GuC to obtain the GMDID value
and existing GuC functions used for that assume that the GT has
it's MMIO members already setup. However, due to recent refactoring
the gt->mmio is initialized later, and any attempt by the VF to use
xe_mmio_read|write() from GuC functions will lead to NPD crash due
to unset MMIO register address:

[] xe 0000:00:02.1: [drm] Running in SR-IOV VF mode
[] xe 0000:00:02.1: [drm] GT0: sending H2G MMIO 0x5507
[] BUG: unable to handle page fault for address: 0000000000190240

Since we are already tweaking the id and type of the primary GT to
mimic it's a Media GT before initializing the GuC communication,
we can also call xe_gt_mmio_init() to perform early setup of the
gt->mmio which will make those GuC functions work again.


Remediation:
To mitigate this issue, prevent the `xe` kernel module from loading. This can be achieved by creating a blacklist rule. Note that this may impact graphics functionality if Intel Xe graphics are in use.

To blacklist the module:
1. Create a file `/etc/modprobe.d/blacklist-xe.conf` with the following content:
   ```
   blacklist xe
   install xe /bin/true
   ```
2. Regenerate the initramfs:
   ```bash
   dracut -f -v
   ```
   or for systems using `mkinitrd`:
   ```bash
   mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)
   ```
3. Reboot the system for the changes to take effect.

This mitigation will prevent the `xe` module from loading at boot. If the module is already loaded, it will remain loaded until the next reboot.
CVE: CVE-2025-15318
Component: Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
Release date: 2025-05-07T00:00:00+00:00

Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
CVE: CVE-2025-27793
Component: vega
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-03-27T14:07:52.264000+00:00

A Cross-site scripting flaw was found in the Vega library for Node.js. In affected versions, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs unless the library was used with the `vega-interpreter.`

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
As a workaround, use `vega` with expression interpreter.
xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors
CVE: CVE-2025-49175
Component: xorg-x11-server-Xwayland
CWE: CWE-125
Severity: Important
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-06-17T00:00:00+00:00

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Statement: This vulnerability is rated as an important severity because the flaw exists in the X Rendering extension of the X.Org X server, specifically in the handling of animated cursors, when a client request provides zero cursors, the server erroneously assumes that at least one cursor is present and proceeds to access elements in the non-existent array. This logic error causes an out-of-bounds read, which can lead to a server crash and denial of service, the flaw could expose limited uninitialized memory, potentially resulting in minor information disclosure.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Incorrect Privilege Assignment
CVE: CVE-2025-41115
Component: grafana
CWE: CWE-266
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-11-25T00:00:00+00:00

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true

Statement: No Red Hat products or offerings are affected by this vulnerability. As the version of grafana (9.x/10.x) shipped in this version of Red Hat Enterprise Linux is not vulnerable to this CVE. The vulnerable versions listed in the CVE posting are >= 12.0.x which are all not in Red Hat Enterprise Linux.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
MediaWiki: Cross-site Scripting vulnerability
CVE: CVE-2025-67477
Component: MediaWiki
CVSS v3: 3.9/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki. An Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), vulnerability exists in the `ApiSandboxLayout.Js` program file. This flaw could potentially allow an attacker with high privileges to inject malicious scripts into web pages. While the direct impact is not specified, XSS vulnerabilities typically enable client-side attacks.

Statement: This vulnerability in MediaWiki allows for stored cross-site scripting (XSS) through a system message in the Special:ApiSandbox feature. An attacker with appropriate privileges to store system messages could inject malicious scripts, potentially leading to arbitrary code execution within a user's browser session. This impact is relevant to Red Hat customers deploying MediaWiki, particularly where untrusted users have permissions to modify system messages.

Remediation:
scsi: target: Reset t_task_cdb pointer in error case
CVE: CVE-2025-68782
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's SCSI target subsystem. When memory allocation for the command descriptor block (CDB) buffer fails, the t_task_cdb pointer remains NULL but is subsequently dereferenced in the error handling path, potentially causing a kernel crash.

Statement: Exploitation requires memory pressure severe enough to fail a small allocation, followed by execution of the specific error path. This issue was identified through static analysis rather than real-world crash reports. The SCSI target subsystem is used primarily in storage server configurations.

Remediation:
Replication unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30685
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:31:00.201000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2025-7240
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:26.402000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26086.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CoreDNS DoS via unbounded connections and oversized messages
CVE: CVE-2025-68151
Component: github.com/coredns/coredns/core/dnsserver
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
PCI: pciehp: Avoid unnecessary device replacement check
CVE: CVE-2025-37843
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: pciehp: Avoid unnecessary device replacement check

Hot-removal of nested PCI hotplug ports suffers from a long-standing race
condition which can lead to a deadlock:  A parent hotplug port acquires
pci_lock_rescan_remove(), then waits for pciehp to unbind from a child
hotplug port.  Meanwhile that child hotplug port tries to acquire
pci_lock_rescan_remove() as well in order to remove its own children.

The deadlock only occurs if the parent acquires pci_lock_rescan_remove()
first, not if the child happens to acquire it first.

Several workarounds to avoid the issue have been proposed and discarded
over the years, e.g.:

https://lore.kernel.org/r/4c882e25194ba8282b78fe963fec8faae7cf23eb.1529173804.git.lukas@wunner.de/

A proper fix is being worked on, but needs more time as it is nontrivial
and necessarily intrusive.

Recent commit 9d573d19547b ("PCI: pciehp: Detect device replacement during
system sleep") provokes more frequent occurrence of the deadlock when
removing more than one Thunderbolt device during system sleep.  The commit
sought to detect device replacement, but also triggered on device removal.
Differentiating reliably between replacement and removal is impossible
because pci_get_dsn() returns 0 both if the device was removed, as well as
if it was replaced with one lacking a Device Serial Number.

Avoid the more frequent occurrence of the deadlock by checking whether the
hotplug port itself was hot-removed.  If so, there's no sense in checking
whether its child device was replaced.

This works because the ->resume_noirq() callback is invoked in top-down
order for the entire hierarchy:  A parent hotplug port detecting device
replacement (or removal) marks all children as removed using
pci_dev_set_disconnected() and a child hotplug port can then reliably
detect being removed.


Remediation:
Path Traversal Vulnerability in mlflow/mlflow
CVE: CVE-2025-15031
Component: mlflow/mlflow
CWE: CWE-22
Severity: Important
CVSS v3: 8.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-01-01T00:00:00+00:00

No description is available for this CVE.


Remediation:
xsk: fix an integer overflow in xp_create_and_assign_umem()
CVE: CVE-2025-21997
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix an integer overflow in xp_create_and_assign_umem()

Since the i and pool->chunk_size variables are of type 'u32',
their product can wrap around and then be cast to 'u64'.
This can lead to two different XDP buffers pointing to the same
memory area.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
scsi: qla2xxx: Delay module unload while fabric scan in progress
CVE: CVE-2025-71235
Component: kernel
CWE: CWE-364
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's qla2xxx Fibre Channel driver. When a module unload is initiated while a fabric scan is in progress, the UNLOADING flag causes work items to be skipped. This results in DMA memory being freed in interrupt context via dma_free_attrs(), which is not allowed and causes a system crash. The fix delays module unload until ongoing fabric scans complete.

Statement: This flaw affects systems with QLogic Fibre Channel HBAs performing module load/unload cycles during active fabric discovery. The crash requires specific timing where a module unload overlaps with an ongoing fabric scan. Normal steady-state operation is unaffected.

Remediation:
To mitigate this issue, prevent the qla2xxx module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
Memory Leak in FFmpeg libavutil/mem.c
CVE: CVE-2025-25468
Component: ffmpeg
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-18T00:00:00+00:00

A flaw was found in FFmpeg. This vulnerability allows an attacker to exhaust memory resources, which can lead to a denial of service via improper memory management.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
privilege escalation by unprivileged users in a ceph-fuse mounted CephFS
CVE: CVE-2025-52555
Component: ceph
CWE: CWE-272
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Release date: 2025-06-26T00:00:00+00:00

A vulnerability in Ceph was discovered whereby an unprivileged user could change the permissions of a directory owned by the root user, gaining access to the targeted directory. The non-privileged user can escalate privileges to root in a CephFS mounted with ceph-fuse by applying chmod 777 (read, write, and execute for all users) to any directory owned by root. This allows the user to read, write, and execute to that directory even if they were not the original owner. The vulnerability could potentially allow a user to gain unauthorized access or modify critical system data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.
InnoDB unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50092
Component: mysql
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-15T19:27:46.243000+00:00

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with network access via multiple protocols to cause a crash in the MySQL server.


Remediation:
drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
CVE: CVE-2025-21978
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: Fix address space leak when Hyper-V DRM device is removed

When a Hyper-V DRM device is probed, the driver allocates MMIO space for
the vram, and maps it cacheable. If the device removed, or in the error
path for device probing, the MMIO space is released but no unmap is done.
Consequently the kernel address space for the mapping is leaked.

Fix this by adding iounmap() calls in the device removal path, and in the
error path during device probing.


Remediation:
Linux kernel: ublk race condition causes kernel crash
CVE: CVE-2025-37906
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.

Fix it by not trying to canceling the command if ublk block request is
started.


Remediation:
Suricata pcre: negated pcr can cause infinite loop
CVE: CVE-2025-29918
Component: Suricata
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-10T21:02:32.646000+00:00

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.