huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
html/template: improper handling of HTML-like comments within script contexts
CVE: CVE-2023-39318
Component: golang
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2023-09-06T00:00:00+00:00

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This issue may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Return Address Predictor vulnerability leading to information disclosure
CVE: CVE-2023-20569
Component: amd
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2023-08-08T11:25:00+00:00

A side channel vulnerability was found in hw amd. Some AMD CPUs may allow an attacker to influence the return address prediction. This issue may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation, other than installed the updated packages, for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
io_uring: drop any code related to SCM_RIGHTS
CVE: CVE-2023-52656
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel that addresses the removal of dead code related to `SCM_RIGHTS` support within the `io_uring`. This code was deemed unnecessary after the kernel dropped the ability to pass `io_uring` file descriptors over `SCM_RIGHTS`. The vulnerability was assigned CVE status due to removing this code, which was part of a cleanup process following the resolution of a previous CVE (CVE-2023-52654).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
USB: sl811: fix memory leak with using debugfs_lookup()
CVE: CVE-2023-53417
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: sl811: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Remediation:
Out of bounds write due to improper code logic after a valid authentication
CVE: CVE-2023-47004
Component: redisgraph
CWE: CWE-787
Severity: Important
CVSS v3: 7.5/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-11-07T00:00:00+00:00

An out-of-bounds write flaw was found in RedisGraph, a module for the Redis server, due to improper code logic after a valid authentication. This issue may lead to arbitrary code execution.

Statement: The default security model [1] for Redis servers dictates that deployments should be made in trusted environments and accessed by trusted clients. Therefore, using the default model, an attacker should only be able to trigger this vulnerability through adjacent networks after compromise of internal access controls.

[1] https://redis.io/docs/management/security/

Remediation:
Incomplete fix for CVE-2020-16305
CVE: CVE-2023-4042
Component: ghostscript
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-08-23T00:00:00+00:00

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Statement: CVE-2020-16305 affected Red Hat Enterprise Linux 6, 7, and 8, but was only intended to be fixed in Red Hat Enterprise Linux 8. (https://access.redhat.com/errata/RHSA-2021:1852 (Red Hat Enterprise Linux 8.4)

That errata provided updates for ghostscript packages, but did not include fixes for CVE-2020-16305 as it was claimed. For more details about the original security issue CVE-2020-16305, refer to the CVE page: https://access.redhat.com/security/cve/CVE-2020-16305.

Remediation:
s390/vmem: split pages when debug pagealloc is enabled
CVE: CVE-2023-54278
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel’s s390/vmem subsystem, a flaw exists in the handling of virtual memory area initialization when debug pagealloc is enabled. Under certain conditions, the kernel may access memory after it has been freed or mishandled during early boot or subsystem initialization, resulting in a use-after-free condition that can cause an early kernel crash or undefined behavior on affected s390 systems.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability
CVE: CVE-2023-51580
Component: bluez
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found within the handling of the AVRCP protocol in BlueZ. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.


Remediation:
tee: amdtee: fix race condition in amdtee_open_session
CVE: CVE-2023-53047
Component: kernel
CWE: CWE-826
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free vulnerability was found in the AMD TEE driver in the Linux kernel. The flaw occurs from a race condition in the `amdtee_open_session()` function, where the session is marked as active in `sess->sess_mask` before the corresponding `sess` structure is fully initialized. If a parallel thread invokes `amdtee_close_session()` during this window of time, it can lead to the structure being freed prematurely. This can lead to system instability, a denial of service, or remote code execution.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
HID: hyperv: avoid struct memcpy overrun warning
CVE: CVE-2023-53553
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A compiler warning issue was found in the Linux kernel's Hyper-V HID driver that could lead to potential memory safety issues. A local user can trigger this issue when the fortified memcpy implementation detects potential buffer overflows in the mousevsc_on_receive function, where the compiler cannot verify that memory copy operations stay within bounds. This could potentially result in memory corruption and denial of service.

Statement: The Hyper-V HID driver's mousevsc_on_receive function performs memcpy operations on packet data received from the Hyper-V host. The fortified string functions (enabled with CONFIG_FORTIFY_SOURCE) perform compile-time checks to detect potential buffer overflows. With certain compiler versions (specifically GCC 9), the fortification checks trigger warnings about potential writes beyond field boundaries. While the code includes proper range checks via WARN_ON, the compiler's data flow analysis is confused by the assertion and cannot verify the bounds are correct. This creates a situation where either the range check is insufficient (potential buffer overflow) or the compiler analysis is overly conservative (false positive). The code was reworked to satisfy the compiler while maintaining safety. The issue affects Hyper-V Linux guests.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the hv_hid module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration
CVE: CVE-2023-54296
Component: kernel
CWE: CWE-386
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's KVM SVM implementation for AMD SEV-ES. During intrahost VM migration, KVM incorrectly retrieves source vCPUs from the destination VM instead of the source VM. This causes the VMSA (Virtual Machine Save Area) pointer to remain NULL, leading to a host kernel crash when the VM is destroyed or during subsequent vCPU operations.

Statement: This bug affects AMD systems using SEV-ES (Secure Encrypted Virtualization - Encrypted State) with VM migration capabilities. The flaw can crash the host kernel from a guest operation, representing a guest-to-host denial of service. However, exploitation requires the ability to perform SEV-ES VM migrations, which typically needs elevated privileges.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
inspector protocol bypass the experimental permission model
CVE: CVE-2023-30587
Component: nodejs
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-06-20T00:00:00+00:00

A vulnerability was found in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).

Statement: Red Hat does not ship Node.js 20.x in any version of RHEL.

Remediation:
amd: failure to sanitize input in SMM
CVE: CVE-2023-20587
Component: hw
CWE: CWE-284
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A vulnerability was found in AMD hardware due to improper access control in System Management Mode (SMM). This issue could allow a local unauthenticated attacker to execute arbitrary code.

Statement: The PSP and AEGIS vulnerabilities necessitate a BIOS update, as they are not inherent to the CPU and cannot be addressed through CPU microcode updates. This requires a UEFI firmware update from the device vendor, distinct from updates in the linux-firmware package. Therefore, linux-firmware on Red Hat Enterprise Linux is marked as not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
dangling pointer in gdev_prn_open_printer_seekable()
CVE: CVE-2023-46751
Component: ghostscript
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-12-06T00:00:00+00:00

A flaw was found in Ghostscript. A remote attacker may use a specially crafted payload to trigger access to previously freed memory, which can potentially lead to remote code execution or an application crash.

Statement: The discovered vulnerability in the function gdev_prn_open_printer_seekable() within Artifex Ghostscript, poses a moderate severity threat due to its potential to cause a denial-of-service (DoS) condition. Exploiting this flaw involves manipulating a dangling pointer, which can lead to crashing the application. While the impact is limited to crashing the application, the exploit requires remote access, which elevates the risk compared to local-only vulnerabilities.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
reachable assertion may lead to denial of service
CVE: CVE-2023-34194
Component: tinyxml
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-12-13T00:00:00+00:00

StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
RemoteCodeExecution - Out-of-bounds write when loading PDB type records in msdia140.dll used by Visual Studio
CVE: CVE-2023-24897
Component: dotnet
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-06-14T00:00:00+00:00

A flaw was found in dotnet. This issue can allow remote code execution through an out-of-bounds write when loading PDB type records in msdia140.dll used by Visual Studio.


Remediation:
ubi: Fix use-after-free when volume resizing failed
CVE: CVE-2023-53800
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free was found in the UBI (Unsorted Block Images) subsystem of the Linux kernel. When ubi_change_vtbl_record() fails during volume resize, the new EBA table is freed but remains referenced by vol->eba_tbl. Subsequent volume operations access this freed memory, triggering use-after-free.

Statement: UBI is used primarily on raw flash devices in embedded systems. Enterprise servers typically use block devices with traditional filesystems, limiting exposure. Triggering this requires failed volume resize operations on UBI volumes.

Remediation:
A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list
CVE: CVE-2023-5717
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-10-25T00:00:00+00:00

A flaw was found in the Linux kernel's Performance Events system component. A condition can be triggered that allows data to be written past the end or before the beginning of the intended memory buffer. This issue may lead to a system crash, code execution, or local privilege escalation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
It is not possible to trigger this issue with the default kernel.perf_event_paranoid sysctl value 2. You may check it with:
cat /proc/sys/kernel/perf_event_paranoid