huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
potential arbitrary code execution via unsafe YAML deserilization
CVE: CVE-2023-49297
Component: pydrive2
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2023-12-05T00:00:00+00:00

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
power: supply: rk817: refcount leak in rk817_charger_probe()
CVE: CVE-2023-52571
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

power: supply: rk817: Fix node refcount leak

Dan Carpenter reports that the Smatch static checker warning has found
that there is another refcount leak in the probe function. While
of_node_put() was added in one of the return paths, it should in
fact be added for ALL return paths that return an error and at driver
removal time.


Remediation:
rsvp: out-of-bounds read in rsvp_classify()
CVE: CVE-2023-39195
Component: kernel
CWE: CWE-125
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:N
Release date: 2023-10-09T00:00:00+00:00

[REJECTED CVE] An out-of-bounds read issue was found in the Linux kernel in the rsvp_classify() function. This flaw requires CAP_NET_ADMIN to be exploited and could lead to information disclosure.

Statement: This flaw was found to be a duplicate of CVE-2023-42755. Please see https://access.redhat.com/security/cve/CVE-2023-42755 for information about affected products and security errata.

Remediation:
Use-after-free bug in DamageDestroy
CVE: CVE-2023-5574
Component: xorg-x11-server
CWE: CWE-416
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-10-25T00:00:00+00:00

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Statement: Xvfb does not run with root privileges in Red Hat Enterprise Linux 7, 8, and 9, therefore, Red Hat Enterprise Linux 7, 8, and 9 have been rated with a moderate severity.

The xorg-x11-server-Xwayland package as shipped by Red Hat Enterprise Linux 8 and 9 is not affected by this issue as Xwayland does not support multiple protocol screens and is not affected by this vulnerability.

Remediation:
Starting Xvfb with the -noreset command line option limits the use-after-free from being triggered only at the Xvfb server shutdown. Also, do not start Xvfb as root.
drm: vmwgfx_surface.c: copy user-array safely
CVE: CVE-2023-52822
Component: kernel
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2023-01-01T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

drm: vmwgfx_surface.c: copy user-array safely

The Linux kernel CVE team has assigned CVE-2023-52822 to this issue.

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2024052435-REJECTED-a3f3@gregkh.

Remediation:
OOB Write ops.c in vim/vim
CVE: CVE-2023-4735
Component: vim
CWE: CWE-787
Severity: Low
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-09-02T00:00:00+00:00

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.


Remediation:
CVE: CVE-2023-42121
Component: Control Web Panel Missing Authentication Remote Code Execution Vulnerability
Release date: 2023-09-27T22:21:44.348000+00:00

Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NFSv4.2: Rework scratch handling for READ_PLUS (again)
CVE: CVE-2023-53360
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: Rework scratch handling for READ_PLUS (again)

I found that the read code might send multiple requests using the same
nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is
how we ended up occasionally double-freeing the scratch buffer, but also
means we set a NULL pointer but non-zero length to the xdr scratch
buffer. This results in an oops the first time decoding needs to copy
something to scratch, which frequently happens when decoding READ_PLUS
hole segments.

I fix this by moving scratch handling into the pageio read code. I
provide a function to allocate scratch space for decoding read replies,
and free the scratch buffer when the nfs_pgio_header is freed.

Statement: A flaw in the NFSv4.2 client’s READ_PLUS handling could double-free the XDR scratch buffer or pass a NULL pointer with a non-zero length, leading to kernel oops during reply decoding (hole segments). The fix moves scratch management into the page-IO read path, allocating with a fixed size and freeing only when the pgio header is released, eliminating both double-free and NULL-deref scenarios. Impact is a potential client-side DoS, possibly triggerable by a malicious or buggy NFS server.
While the bug is a double-free/NULL dereference and in theory could be abused as a memory corruption issue, in practice it only manifests as a client-side crash (DoS). Exploitation for code execution is not considered realistic.

Remediation:
unsanitized admin input leads to DoS
CVE: CVE-2023-29195
Component: vitess
Release date: 2023-05-11T00:00:00+00:00

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
CVE: CVE-2023-52988
Component: kernel
CWE: CWE-129
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's ALSA subsystem in the `add_secret_dac_path()` function, where improper array handling can lead to out-of-bounds access. This occurs if the return value of the call to `snd_hda_get_connections()` returns an error code (a negative number), which is stored in the variable `nums` that is then used as the upper bound of a for loop used to access the `conn` structure. This issue could lead to undefined behavior or a memory crash due to invalid memory access.

Statement: Red Hat rated this vulnerability with a MODERATE impact because an attacker would need access to load/manipulate ALSA codec data, which requires elevated privileges.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Inappropriate implementation in Fullscreen
CVE: CVE-2023-4365
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-08-15T00:00:00+00:00

Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34;
CVE: CVE-2023-52658
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

CVE-2023-52658 is a vulnerability in the Linux kernel's Mellanox MLX5 driver, specifically related to the switchdev mode. A previous commit intended to block entering switchdev mode due to namespace inconsistencies inadvertently caused system crashes. To address this, the problematic commit was reverted, restoring stability. Users should update their Linux kernel to a version that includes this reversion to ensure reliable operation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
heap buffer overflow in xls_parseWorkBook() in xls.c
CVE: CVE-2023-38854
Component: libxls
CVSS v3: 0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Release date: 2023-08-15T00:00:00+00:00

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296.

Statement: This flaw was found to be a duplicate of CVE-2023-38852. Please see https://access.redhat.com/security/cve/CVE-2023-38852 for information about affected products and security errata.

Remediation:
Inappropriate implementation in Prompts
CVE: CVE-2023-2462
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-05-02T00:00:00+00:00

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
processing web content may lead to arbitrary code execution
CVE: CVE-2023-41074
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-09-28T00:00:00+00:00

The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.

Statement: The webkitgtk versions as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability. This flaw relies on webkitgtk's JIT to be enabled while this feature was previously disabled in Red Hat Enterprise Linux 8 and 9 by the following erratas:

Red Hat Enterprise Linux 8: https://access.redhat.com/errata/RHSA-2023:4202
Red Hat Enterprise Linux 9: https://access.redhat.com/errata/RHSA-2023:4201

Remediation:
CVE: CVE-2023-50235
Component: Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-12-20T22:54:04.422000+00:00

Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hancom Office Show. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PPT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20387.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple CVEs published by Talos
CVE: CVE-2023-39316
Component: gtkwave
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_pointers` array.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
CVE: CVE-2023-53049
Component: kernel
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()

When ucsi_init() fails, ucsi->connector is NULL, yet in case of
ucsi_acpi we may still get events which cause the ucs_acpi code to call
ucsi_connector_change(), which then derefs the NULL ucsi->connector
pointer.

Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init()
has succeeded, so that ucsi_connector_change() ignores the events
because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask.

Statement: A NULL pointer dereference vulnerability in the UCSI USB Type-C subsystem was fixed in ucsi_connector_change(). If ucsi_init() fails, a race condition may cause connector change events to be processed with an uninitialized ucsi->connector, leading to a kernel crash. This can be triggered locally from userspace on systems with UCSI ACPI interface, but requires high privileges and a specific device configuration.

Remediation:
stack-based buffer overflow in Criteria.parse method
CVE: CVE-2023-51074
Component: json-path
CWE: CWE-121
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-12-27T00:00:00+00:00

A stack overflow vulnerability was found in the Criteria.parse() method in json-path. This issue occurs due to an uncontrolled recursion caused by specially crafted input, leading to a stack overflow. This vulnerability has the potential to trigger a crash, resulting in a denial of service.

Statement: Red Hat rates this at maximum of a Moderate impact. When interacting with a server to explore this possible vulnerability, the attacker would be the only one seeing a HTTP 500 error and no other user (or the server entirely) would be vulnerable in a real application scenario with multi-threads.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
CVE: CVE-2023-54276
Component: kernel
CWE: CWE-665
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was identified in the NFS server (nfsd) implementation in the Linux kernel where the initialization of the per-CPU reply_cache_stats counters was relocated incorrectly in the code path. This change can lead to use of uninitialized per-CPU statistical counters during NFS request handling when the relevant net namespace is set up, leading to inconsistent or stale data and potentially unresolved kernel state.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
CVE: CVE-2023-53419
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access

For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can
result in a NULL-pointer dereference:

           CPU1                                           CPU2
rcu_preempt_deferred_qs_irqrestore                rcu_print_task_exp_stall
  if (special.b.blocked)                            READ_ONCE(rnp->exp_tasks) != NULL
    raw_spin_lock_rcu_node
    np = rcu_next_node_entry(t, rnp)
    if (&t->rcu_node_entry == rnp->exp_tasks)
      WRITE_ONCE(rnp->exp_tasks, np)
      ....
      raw_spin_unlock_irqrestore_rcu_node
                                                    raw_spin_lock_irqsave_rcu_node
                                                    t = list_entry(rnp->exp_tasks->prev,
                                                        struct task_struct, rcu_node_entry)
                                                    (if rnp->exp_tasks is NULL, this
                                                       will dereference a NULL pointer)

The problem is that CPU2 accesses the rcu_node structure's->exp_tasks
field without holding the rcu_node structure's ->lock and CPU2 did
not observe CPU1's change to rcu_node structure's ->exp_tasks in time.
Therefore, if CPU1 sets rcu_node structure's->exp_tasks pointer to NULL,
then CPU2 might dereference that NULL pointer.

This commit therefore holds the rcu_node structure's ->lock while
accessing that structure's->exp_tasks field.

[ paulmck: Apply Frederic Weisbecker feedback. ]


Remediation:
Use after free in PDF
CVE: CVE-2023-2931
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-05-30T00:00:00+00:00

Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arbitrary file write with privileges of the RunAs user
CVE: CVE-2023-22809
Component: sudo
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-18T15:00:00+00:00

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user (usually root). The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a file using sudoedit.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
It is possible to prevent a user-specified editor from being used by sudoedit by adding the following line to the sudoers file.
~~~
Defaults!sudoedit    env_delete+="SUDO_EDITOR VISUAL EDITOR"
~~~

To restrict the editor when editing specific files, a Cmnd_Alias can be used, for example:
~~~
Cmnd_Alias              EDIT_MOTD = sudoedit /etc/motd
Defaults!EDIT_MOTD      env_delete+="SUDO_EDITOR VISUAL EDITOR"
user                    ALL = EDIT_MOTD
~~~
But if possible please update the affected package as soon as possible.
process interuption due to invalid Public Key information in x509 certificates
CVE: CVE-2023-30588
Component: nodejs
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-06-20T00:00:00+00:00

A vulnerability has been identified in the Node.js, where an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario.


Remediation: