huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
crash due to a missing check for leb_size
CVE: CVE-2024-25739
Component: kernel
CWE: CWE-754
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-02-12T00:00:00+00:00

A flaw was found in the Linux kernel. The create_empty_lvol function in the drivers/mtd/ubi/vtbl.c file can attempt to allocate zero bytes of memory when the LEB size is smaller than a single volume table record. This issue can result in a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Denial of service when processing a specially crafted Spring Expression Language expression
CVE: CVE-2024-38808
Component: spring-expression
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-20T00:00:00+00:00

A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language (SePL) may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Database user and password stored in plain-text
CVE: CVE-2024-3624
Component: mirror-registry
CWE: CWE-256
Severity: Moderate
CVSS v3: 7.4/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2024-04-10T00:00:00+00:00

A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.


Remediation:
tagging.py can use an incorrect ID during policy enforcement
CVE: CVE-2024-53916
Component: openstack-neutron
CWE: CWE-345
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2024-11-24T00:00:00+00:00

A flaw was found in OpenStack Neutron. The service tagging policy engine insufficiently verifies the parent resource or the upper parent resource project ID when checking the policies against the caller project ID.


Remediation:
denial of service
CVE: CVE-2024-27354
Component: php-phpseclib
Release date: 2024-03-01T00:00:00+00:00

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: musb: sunxi: Fix accessing an released usb phy
CVE: CVE-2024-50269
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: sunxi: Fix accessing an released usb phy

Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on
exit") will cause that usb phy @glue->xceiv is accessed after released.

1) register platform driver @sunxi_musb_driver
// get the usb phy @glue->xceiv
sunxi_musb_probe() -> devm_usb_get_phy().

2) register and unregister platform driver @musb_driver
musb_probe() -> sunxi_musb_init()
use the phy here
//the phy is released here
musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()

3) register @musb_driver again
musb_probe() -> sunxi_musb_init()
use the phy here but the phy has been released at 2).
...

Fixed by reverting the commit, namely, removing devm_usb_put_phy()
from sunxi_musb_exit().


Remediation:
CVE: CVE-2024-7237
Component: AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability
Release date: 2024-07-29T21:37:14.706000+00:00

AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the AVG Service. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22960.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: Fix icmp host relookup triggering ip_rt_bug
CVE: CVE-2024-56647
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

A denial of service vulnerability was found in the Linux kernel. icmp_route_lookup() creates input routes for locally generated packets during xfrm relookup ICMP traffic. Then it will set the input route (dst->out = ip_rt_bug) to skb for DESTUNREACH, leading to loss of availability of the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
io_uring: fix error pbuf checking
CVE: CVE-2024-42254
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix error pbuf checking

Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent
error handling in io_alloc_pbuf_ring().

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341
Call Trace:
 <TASK>
 io_put_bl io_uring/kbuf.c:378 [inline]
 io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392
 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613
 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244


Remediation:
From CVEorg collector
CVE: CVE-2024-21280
Component: Oracle E-Business Suite
Release date: 2024-10-15T19:53:01.851000+00:00

Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring).  Supported versions that are affected are 12.2.5-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Contracts.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Service Contracts accessible data as well as  unauthorized access to critical data or complete access to all Oracle Service Contracts accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OOB-read in qtdemux_parse_container
CVE: CVE-2024-47543
Component: gstreamer1-plugins-good
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2024-12-11T18:55:50.210000+00:00

A flaw was found in the GStreamer library. An out-of-bounds read in the MP4/MOV demuxer can lead to crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.


Remediation:
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
CVE: CVE-2024-36953
Component: kernel
CWE: CWE-158
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

vgic_v2_parse_attr() is responsible for finding the vCPU that matches
the user-provided CPUID, which (of course) may not be valid. If the ID
is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled
gracefully.

Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id()
actually returns something and fail the ioctl if not.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
CVE: CVE-2024-43853
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

A use-after-free (UAF) flaw was found in the proc_cpuset_show() function. This issue can allow an attacker to access the css of the root caused by a race condition when the cgroup_root should be freed when it is unmounted from the resource.

Statement: The cpuset resource can only impact the availability of the system by skipping limitations from the CPU and causing a Denial of Service attack.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
No mitigation is available for this issue other than updating the affected package to the version containing the fix.
processing malicious web content may lead to denial-of-service
CVE: CVE-2024-23252
Component: webkit
Severity: None
Release date: 2024-03-07T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
CVE: CVE-2024-56702
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark raw_tp arguments with PTR_MAYBE_NULL

Arguments to a raw tracepoint are tagged as trusted, which carries the
semantics that the pointer will be non-NULL.  However, in certain cases,
a raw tracepoint argument may end up being NULL. More context about this
issue is available in [0].

Thus, there is a discrepancy between the reality, that raw_tp arguments
can actually be NULL, and the verifier's knowledge, that they are never
NULL, causing explicit NULL checks to be deleted, and accesses to such
pointers potentially crashing the kernel.

To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special
case the dereference and pointer arithmetic to permit it, and allow
passing them into helpers/kfuncs; these exceptions are made for raw_tp
programs only. Ensure that we don't do this when ref_obj_id > 0, as in
that case this is an acquired object and doesn't need such adjustment.

The reason we do mask_raw_tp_trusted_reg logic is because other will
recheck in places whether the register is a trusted_reg, and then
consider our register as untrusted when detecting the presence of the
PTR_MAYBE_NULL flag.

To allow safe dereference, we enable PROBE_MEM marking when we see loads
into trusted pointers with PTR_MAYBE_NULL.

While trusted raw_tp arguments can also be passed into helpers or kfuncs
where such broken assumption may cause issues, a future patch set will
tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can
already be passed into helpers and causes similar problems. Thus, they
are left alone for now.

It is possible that these checks also permit passing non-raw_tp args
that are trusted PTR_TO_BTF_ID with null marking. In such a case,
allowing dereference when pointer is NULL expands allowed behavior, so
won't regress existing programs, and the case of passing these into
helpers is the same as above and will be dealt with later.

Also update the failure case in tp_btf_nullable selftest to capture the
new behavior, as the verifier will no longer cause an error when
directly dereference a raw tracepoint argument marked as __nullable.

  [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:

    cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Remediation:
CVE: CVE-2024-7722
Component: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
Release date: 2024-08-13T21:49:30.304000+00:00

Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23702.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
CVE: CVE-2024-42311
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

A flaw was found in the HFS filesystem in the Linux kernel due to uninitialized fields in the hfs_inode_info structure. The .tz_secondswest, .cached_start, and .cached_blocks fields are not initialized after calling hfs_alloc_inode(). This omission led to undefined behavior and potential security issues, as reported by the Kernel Memory Sanitizer (KMSAN).

Statement: Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
CVE: CVE-2024-50286
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

There is a race condition between ksmbd_smb2_session_create and
ksmbd_expire_session. This patch add missing sessions_table_lock
while adding/deleting session from global session table.


Remediation:
thunderbolt: Mark XDomain as unplugged when router is removed
CVE: CVE-2024-46702
Component: kernel
CWE: CWE-367
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets
hot-removed from the PCIe side as a result of NVM firmware authentication,
if there is another host connected with enabled paths we hang in tearing
them down. This is due to fact that the Thunderbolt networking driver
also tries to cleanup the paths and ends up blocking in
tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so
there is really no need for tb_disconnect_xdomain_paths() to do that
anymore. Furthermore it already checks if the XDomain is unplugged and
bails out early so take advantage of that and mark the XDomain as
unplugged when we remove the parent router.


Remediation:
drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv
CVE: CVE-2024-26729
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel. This issue occurs in the dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up() functions, where the dc_dmub_srv variable is dereferenced before being checked for NULL. This could lead to a NULL pointer dereference, causing memory corruption or crashes.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Remediation:
netfilter: nfnetlink: Initialise extack before use in ACKs
CVE: CVE-2024-44945
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-08-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink: Initialise extack before use in ACKs

Add missing extack initialisation when ACKing BATCH_BEGIN and BATCH_END.

Statement: Assessed metadata without initialization may not be in controlled by the attacker and hence this C and I should be limited exploitable.

Remediation:
wifi: cfg80211: detect stuck ECSA element in probe resp
CVE: CVE-2024-26683
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-02T00:00:00+00:00

A vulnerability was found in the Linux kernel. This issue occurs when an AP continually advertises a stuck ECSA element, leading to incorrect channel switch process handling. This can lead to network connectivity issues if the AP is stuck in a state where it continuously advertises a false channel switch.


Remediation:
Algorithm confusion when verifying JSON Web Tokens with asymmetric public keys
CVE: CVE-2024-37568
Component: python-authlib
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-06-09T00:00:00+00:00

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
CVE: CVE-2024-50005
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mac802154: Fix potential RCU dereference issue in mac802154_scan_worker

In the `mac802154_scan_worker` function, the `scan_req->type` field was
accessed after the RCU read-side critical section was unlocked. According
to RCU usage rules, this is illegal and can lead to unpredictable
behavior, such as accessing memory that has been updated or causing
use-after-free issues.

This possible bug was identified using a static analysis tool developed
by myself, specifically designed to detect RCU-related issues.

To address this, the `scan_req->type` value is now stored in a local
variable `scan_req_type` while still within the RCU read-side critical
section. The `scan_req_type` is then used after the RCU lock is released,
ensuring that the type value is safely accessed without violating RCU
rules.


Remediation:
net/mlx5: Always stop health timer during driver removal
CVE: CVE-2024-40906
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's mlx5 driver, in the driver removal process where the teardown_hca function can fail, where the health timer may continue running, leading to a use-after-free condition when the timer attempts to access freed resources.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.