huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
rxrpc: Fix handling of received connection abort
CVE: CVE-2024-58053
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix handling of received connection abort

Fix the handling of a connection abort that we've received.  Though the
abort is at the connection level, it needs propagating to the calls on that
connection.  Whilst the propagation bit is performed, the calls aren't then
woken up to go and process their termination, and as no further input is
forthcoming, they just hang.

Also add some tracing for the logging of connection aborts.


Remediation:
improper input validation in bgp_attr_encap() in bgpd/bgp_attr.c
CVE: CVE-2024-44070
Component: frr
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-18T00:00:00+00:00

A flaw was found in FRRouting (FRR). Improper input validation in the bgp_attr_encap function in the bgpd/bgp_attr.c file of the remaining stream length before assigning the TLV value can cause the bgpd daemon to crash, resulting in a denial of service.

Statement: Due to security checks performed by FRR, the abort function is called when this flaw is triggered, terminating the process immediately. Thus, this issue can only cause the bgpd daemon to crash, resulting in a denial of service with no other security impact.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
media: tc358743: register v4l2 async device only after successful setup
CVE: CVE-2024-35830
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-17T00:00:00+00:00

A vulnerability was found in the Linux kernel's `media: tc358743` driver. This issue occurs due to the v4l2 async device being registered before successful completion of the device setup process, leading to improper initialization or instability.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: cfg80211: validate HE operation element parsing
CVE: CVE-2024-40930
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.9/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's cfg80211 component, related to the parsing of HE operation elements, where the issue occurs when the length of the HE operation element is not validated before parsing, potentially leading to buffer overflows or undefined behavior.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
hive: RCE through AWS/Kubernetes client configuration leads to privilege escalation
CVE: CVE-2024-25133
Component: openshift-dedicated
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-06-12T20:21:00+00:00

A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out of bounds stack write due to pointer-to-integer types conversion
CVE: CVE-2024-1013
Component: unixODBC
CWE: CWE-823
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-03-18T00:00:00+00:00

An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.

Statement: Red Hat does not ship this vulnerable code in any versions of Red Hat Enterprise Linux.

Remediation:
mm, slub: do not call do_slab_free for kfence object
CVE: CVE-2024-44973
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm, slub: do not call do_slab_free for kfence object

In 782f8906f805 the freeing of kfence objects was moved from deep
inside do_slab_free to the wrapper functions outside. This is a nice
change, but unfortunately it missed one spot in __kmem_cache_free_bulk.

This results in a crash like this:

BUG skbuff_head_cache (Tainted: G S  B       E     ): Padding overwritten. 0xffff88907fea0f00-0xffff88907fea0fff @offset=3840

slab_err (mm/slub.c:1129)
free_to_partial_list (mm/slub.c:? mm/slub.c:4036)
slab_pad_check (mm/slub.c:864 mm/slub.c:1290)
check_slab (mm/slub.c:?)
free_to_partial_list (mm/slub.c:3171 mm/slub.c:4036)
kmem_cache_alloc_bulk (mm/slub.c:? mm/slub.c:4495 mm/slub.c:4586 mm/slub.c:4635)
napi_build_skb (net/core/skbuff.c:348 net/core/skbuff.c:527 net/core/skbuff.c:549)

All the other callers to do_slab_free appear to be ok.

Add a kfence_free check in __kmem_cache_free_bulk to avoid the crash.


Remediation:
Cross-site Scripting (XSS) via break_long_headers
CVE: CVE-2024-21520
Component: djangorestframework
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2024-06-26T00:00:00+00:00

A vulnerability was found in the djangorestframework package. Cross-site scripting occurs via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.


Remediation:
Red Hat Ansible Automation Platform
Potential user email enumeration via response status on password reset
CVE: CVE-2024-45231
Component: python-django
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-09-03T00:00:00+00:00

A flaw was found in Python's Django package. This flaw allows an attacker to enumerate users' emails by issuing password reset requests.

Statement: This vulnerability is classified as a Low severity as it only poses a low impact to confidentiality.

Remediation:
CVE: CVE-2024-30331
Component: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-03-28T12:37:50.333000+00:00

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22637.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
using the fetch() function to retrieve content from an untrusted URL leads to denial of service
CVE: CVE-2024-22025
Component: nodejs
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-03-19T00:00:00+00:00

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fetch() function in Node.js that always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. This flaw allows an attacker to control the URL passed into fetch() to exhaust memory, potentially leading to process termination, depending on the system configuration.

Statement: The identified flaw in Node.js, which involves the fetch() function always decoding Brotli content regardless of its source, represents a moderate severity issue due to its potential to facilitate denial of service attacks through resource exhaustion. This vulnerability allows malicious actors to manipulate the URL parameter passed into fetch(), exploiting the consistent Brotli decoding behavior to overwhelm system memory resources. While the impact is constrained to process termination, its severity is moderated by the requirement for specific conditions, such as untrusted URLs and system configurations.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2024-8818
Component: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-09-17T16:23:53.734000+00:00

PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24213.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
loop in the PDF resources leads to infinite recursion
CVE: CVE-2024-4568
Component: xpdf
CWE: CWE-674
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-05-06T00:00:00+00:00

A flaw was found in Xpdf. A PDF object loop in the PDF resources can lead to infinite recursion and a stack overflow, resulting in an application crash.


Remediation:
buffer overflow in rgbe_RGBEToFloat() function when reading images in HDR format
CVE: CVE-2024-28582
Component: freeimage
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-03-20T00:00:00+00:00

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the rgbe_RGBEToFloat() function when reading images in HDR format.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
CVE: CVE-2024-26965
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux Kernel's qcom mmcc-msm8974.c driver, where out-of-bounds access can occur when the frequency table arrays are traversed by functions like qcom_find_freq() or qcom_find_freq_floor() as the arrays are not terminated with an empty element. This can lead to memory corruption or system instability.

Statement: Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
improper auth controls can allow circumvention of Document Level Security
CVE: CVE-2024-12539
Component: elasticsearch
CWE: CWE-863
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-12-17T20:50:04.968000+00:00

In some versions of Elasticsearch, improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security. This may allow users to access to documents that their roles would normally not allow.

Statement: This issue is specific to versions 8.16.0 and 8.16.1. Red Hat does not ship an affected version of this component.

Remediation:
SQL injection in user.get API
CVE: CVE-2024-42327
Component: zabbix
Release date: 2024-11-27T12:04:31.950000+00:00

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Misinterpretation of input may lead to improper behavior
CVE: CVE-2024-38428
Component: wget
CWE: CWE-115
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2024-06-01T00:00:00+00:00

A flaw was found in wget. Incorrect handling of semicolons in the userinfo subcomponent of a URI allows it to be misinterpreted as part of the host subcomponent, potentially exposing user credentials.

Statement: Only calls to Wget using semicolons in the userinfo subcomponent of a URI are vulnerable to this issue. However, this is allowed by the standard and is supported by other similar tools.
To exploit this issue, an attacker must convince a local user into running Wget with a specially crafted userinfo subcomponent, limiting the exposure of this vulnerability.
For these reasons, this vulnerability has been rated with a moderate severity.

Additionally, this vulnerability only affects wget 1.x, wget2 is not affected.

Remediation:
Make sure to not add semicolons in the userinfo subcomponent of a URI.
nilfs2: fix potential hang in nilfs_detach_log_writer()
CVE: CVE-2024-38582
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-19T00:00:00+00:00

A flaw was found in the Linux kernel. A potential hang in nilfs_detach_log_writer() may lead to compromised availability.

Statement: No Red Hat products are affected by this vulnerability.

Remediation:
s390/fpu: Re-add exception handling in load_fpu_state()
CVE: CVE-2024-43865
Component: kernel
CWE: CWE-703
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2024-08-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/fpu: Re-add exception handling in load_fpu_state()

With the recent rewrite of the fpu code exception handling for the
lfpc instruction within load_fpu_state() was erroneously removed.

Add it again to prevent that loading invalid floating point register
values cause an unhandled specification exception.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
From CVEorg collector
CVE: CVE-2024-21259
Component: Oracle Virtualization
Release date: 2024-10-15T19:52:53.966000+00:00

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 7.0.22 and  prior to 7.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
CVE: CVE-2024-36965
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-08T00:00:00+00:00

A vulnerability was found in the Linux kernel's MediaTek remote processor driver. The Inter-Processor Interrupt (IPI) buffers were not properly validated to ensure they fit within the L2 Tightly Coupled Memory (L2TCM). This issue could lead to buffer overflows or memory corruption.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Howyar UEFI Application "Reloader": Unsigned software execution via hardcoded path
CVE: CVE-2024-7344
Component: howyar-sysreturn
Release date: 2024-01-01T00:00:00+00:00

Howyar UEFI Application "Reloader"  (32-bit and 64-bit)  is vulnerable to execution of unsigned software in a hardcoded path.

Statement: Red Hat components are not directly affected by CVE-2024-7344. However, until the DBX entries are updated on a system, it is possible for an attacker to boot the affected EFI applications even with secure boot protections enabled. Once the affected vendors have released a DBX update, it should be installed through fwupd via LVFS.

Remediation:
abnormal termination when using auto_sni with authority header longer than 255 characters
CVE: CVE-2024-32475
Component: envoy
CWE: CWE-617
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-18T00:00:00+00:00

A flaw was found in Envoy, a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with "auto_sni" enabled, a request containing a "host/:authority" header longer than 255 characters triggers an abnormal termination of the Envoy process, leading to a denial of service.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
drm/stm: Avoid use-after-free issues with crtc and plane
CVE: CVE-2024-49992
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/stm: Avoid use-after-free issues with crtc and plane

ltdc_load() calls functions drm_crtc_init_with_planes(),
drm_universal_plane_init() and drm_encoder_init(). These functions
should not be called with parameters allocated with devm_kzalloc()
to avoid use-after-free issues [1].

Use allocations managed by the DRM framework.

Found by Linux Verification Center (linuxtesting.org).

[1]
https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/


Remediation:
uses strcmp to verify authentication to bypass authentication via a timing side channel
CVE: CVE-2024-23771
Component: darkhttpd
Release date: 2024-01-22T00:00:00+00:00

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/v3d: Fix potential memory leak in the performance extension
CVE: CVE-2024-42262
Component: kernel
CWE: CWE-402
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix potential memory leak in the performance extension

If fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.

Fix it by exporting and using a common cleanup helper.

(cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501)


Remediation:
gpio: graniterapids: Fix vGPIO driver crash
CVE: CVE-2024-56671
Component: kernel
CWE: CWE-843
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: graniterapids: Fix vGPIO driver crash

Move setting irq_chip.name from probe() function to the initialization
of "irq_chip" struct in order to fix vGPIO driver crash during bootup.

Crash was caused by unauthorized modification of irq_chip.name field
where irq_chip struct was initialized as const.

This behavior is a consequence of suboptimal implementation of
gpio_irq_chip_set_chip(), which should be changed to avoid
casting away const qualifier.

Crash log:
BUG: unable to handle page fault for address: ffffffffc0ba81c0
/#PF: supervisor write access in kernel mode
/#PF: error_code(0x0003) - permissions violation
CPU: 33 UID: 0 PID: 1075 Comm: systemd-udevd Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 #1
Hardware name: Intel Corporation Kaseyville RP/Kaseyville RP, BIOS KVLDCRB1.PGS.0026.D73.2410081258 10/08/2024
RIP: 0010:gnr_gpio_probe+0x171/0x220 [gpio_graniterapids]


Remediation: