huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
btrfs: clean up our handling of refs == 0 in snapshot delete
CVE: CVE-2024-46840
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: clean up our handling of refs == 0 in snapshot delete

In reada we BUG_ON(refs == 0), which could be unkind since we aren't
holding a lock on the extent leaf and thus could get a transient
incorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which
could happen if we have extent tree corruption.  Change that to return
-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,
however we return -EIO, which -EUCLEAN is a more appropriate error code.
Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert
that to proper error handling.  Also adjust the error message so we can
actually do something with the information.


Remediation:
serial: mxs-auart: add spinlock around changing cts state
CVE: CVE-2024-27000
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

A flaw was found in the mxs-auart module in the Linux kernel. A race condition can occur when changing the cts state due to a missing lock, potentially impacting system stability and possibly resulting in a denial of service.

Statement: The mxs-auart module is not built in the kernel shipped in Red Hat Enterprise Linux 8 and 9, so it is not affected by this vulnerability.

Remediation:
ptp: fix integer overflow in max_vclocks_store
CVE: CVE-2024-40994
Component: kernel
CWE: CWE-190
Severity: Low
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ptp subsystem in ptp_sysfs.c file, where the max_vclocks_store function can cause an integer overflow on 32-bit systems. This issue occurs during a multiplication operation, potentially leading to incorrect memory allocation, resulting in memory corruption.

Statement: The function where incorrect initialization of memory could happen is not being used. The idea is to make param max_vclocks configurable via /sys/class/ptp/ptpN/max_vclocks. However, /sys/class/ptp/ptp0/max_vclocks does not exist yet and this function is not being called.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mptcp: prevent BPF accessing lowat from a subflow socket.
CVE: CVE-2024-35894
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mptcp: prevent BPF accessing lowat from a subflow socket.

Alexei reported the following splat:

 WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0
 Modules linked in: dummy bpf_testmod(O) [last unloaded: bpf_test_no_cfi(O)]
 CPU: 32 PID: 3276 Comm: test_progs Tainted: GO       6.8.0-12873-g2c43c33bfd23
 Call Trace:
  <TASK>
  mptcp_set_rcvlowat+0x79/0x1d0
  sk_setsockopt+0x6c0/0x1540
  __bpf_setsockopt+0x6f/0x90
  bpf_sock_ops_setsockopt+0x3c/0x90
  bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b
  bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b/0x132
  bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86
  __cgroup_bpf_run_filter_sock_ops+0xbc/0x250
  tcp_connect+0x879/0x1160
  tcp_v6_connect+0x50c/0x870
  mptcp_connect+0x129/0x280
  __inet_stream_connect+0xce/0x370
  inet_stream_connect+0x36/0x50
  bpf_trampoline_6442491565+0x49/0xef
  inet_stream_connect+0x5/0x50
  __sys_connect+0x63/0x90
  __x64_sys_connect+0x14/0x20

The root cause of the issue is that bpf allows accessing mptcp-level
proto_ops from a tcp subflow scope.

Fix the issue detecting the problematic call and preventing any action.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Lack of Approval Check for Rebuilt Jenkins Pipelines
CVE: CVE-2024-52550
Component: jenkins-plugin/workflow-cps
CWE: CWE-862
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-11-13T20:53:00.972000+00:00

A flaw was found in the Jenkins Pipeline: Groovy Plugin (jenkins-plugin/workflow-cps). This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main (Jenkinsfile) script is no longer approved, bypassing script approval checks via the rebuild action.

Statement: This vulnerability is considered of important severity rather than moderate because it allows attackers with the `Item/Build` permission to trigger the execution of previously unapproved Jenkinsfiles during the rebuild process. Jenkinsfiles often contain critical pipeline scripts that can interact with sensitive systems and data, including environment variables, credentials, and system configurations. If these scripts are not properly approved, malicious or unauthorized code could be executed, potentially leading to arbitrary code execution, privilege escalation, or data manipulation. The lack of a re-approval check for rebuilt builds bypasses essential security controls, which can be exploited by attackers to gain unauthorized access or compromise the integrity of the build process.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: fec: don&#39;t save PTP state if PTP is unsupported
CVE: CVE-2024-50097
Component: kernel
CWE: CWE-704
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: fec: don't save PTP state if PTP is unsupported

Some platforms (such as i.MX25 and i.MX27) do not support PTP, so on
these platforms fec_ptp_init() is not called and the related members
in fep are not initialized. However, fec_ptp_save_state() is called
unconditionally, which causes the kernel to panic. Therefore, add a
condition so that fec_ptp_save_state() is not called if PTP is not
supported.


Remediation:
Inappropriate implementation in V8
CVE: CVE-2024-6772
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-07-16T00:00:00+00:00

An inappropriate implementation flaw was found in V8 in Google Chrome. This issue may allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds read in LuaJIT
CVE: CVE-2024-25178
Component: luajit
CWE: CWE-125
Severity: Low
CVSS v3: 2.3/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-01-01T00:00:00+00:00

An out-of-bounds read was found in LuaJIT. This issue was uncovered through fuzzing, and no real-world exploit has been demonstrated.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Bluetooth: Call iso_exit() on module unload
CVE: CVE-2024-50078
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Call iso_exit() on module unload

If iso_init() has been called, iso_exit() must be called on module
unload. Without that, the struct proto that iso_init() registered with
proto_register() becomes invalid, which could cause unpredictable
problems later. In my case, with CONFIG_LIST_HARDENED and
CONFIG_BUG_ON_DATA_CORRUPTION enabled, loading the module again usually
triggers this BUG():

  list_add corruption. next->prev should be prev (ffffffffb5355fd0),
    but was 0000000000000068. (next=ffffffffc0a010d0).
  ------------[ cut here ]------------
  kernel BUG at lib/list_debug.c:29!
  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 1 PID: 4159 Comm: modprobe Not tainted 6.10.11-4+bt2-ao-desktop #1
  RIP: 0010:__list_add_valid_or_report+0x61/0xa0
  ...
    __list_add_valid_or_report+0x61/0xa0
    proto_register+0x299/0x320
    hci_sock_init+0x16/0xc0 [bluetooth]
    bt_init+0x68/0xd0 [bluetooth]
    __pfx_bt_init+0x10/0x10 [bluetooth]
    do_one_initcall+0x80/0x2f0
    do_init_module+0x8b/0x230
    __do_sys_init_module+0x15f/0x190
    do_syscall_64+0x68/0x110
  ...

Statement: The bug happens only when admin unloads and then loads again Bluetooth kernel module, so impact is limited.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module bluetooth from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
SSRF in Apache HTTP Server with mod_proxy loaded
CVE: CVE-2024-43204
Component: httpd
CWE: CWE-918
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2024-01-01T00:00:00+00:00

A Server-side request forgery (SSRF) vulnerability exists in Apache httpd when the server has mod_proxy loaded and is configured with mod_headers to modify the Content-Type header in the HTTP request or response using a value supplied by the user. Under this configuration, this flaw allows an attacker to craft specially crafted requests to manipulate the Content-Type header and trigger outbound requests to arbitrary attacker-controlled URLs via proxy. The vulnerability stems from inadequate input validation and unsafe header manipulation, ultimately allowing an attacker to influence server-side network behavior.

Statement: Exploitation requires a non-default and uncommon server configuration where mod_headers is configured to modify the Content-Type request or a response header with a value provided in the HTTP request.

This issue is rated as a Moderate vulnerability primarily due to its reliance on a non-default and uncommon server configuration, which significantly limits its exploitability. Specifically, successful exploitation requires the Apache HTTP Server to have both mod_proxy and mod_headers enabled, and for mod_headers to be explicitly misconfigured to set or modify the Content-Type header using unvalidated user input—a rare and generally discouraged setup. Moreover, the SSRF does not result in information disclosure, privilege escalation, or code execution, but merely allows outbound connections from the server to attacker-controlled endpoints.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Sensitive information disclosure
CVE: CVE-2024-35178
Component: python-jupyter-server
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-06-06T00:00:00+00:00

The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fs/tar: Integer Overflow causes Heap OOB Write
CVE: CVE-2024-45780
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.

Statement: To exploit this flaw, an attacker needs to trick a user into running grub2 with a specially crafted tar file system image, limiting the exposure of this flaw. For this reason, this vulnerability has been rated with a Moderate severity.

The grub2 package as shipped in Red Hat Enterprise Linux 7, 8, 9 and in Red Hat OpenShift Container Platform 4 is not affected by this vulnerability because the tar module is not built, so this issue is not applicable.

Remediation:
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
CVE: CVE-2024-26754
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the gtp_genl_dump_pdp() function in the Linux kernel. This issue occurs due to incorrect initialization order and error handling, which can lead to use-after-free and NULL pointer dereference issues. This vulnerability could also cause undefined behaviors or crashes.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Remediation:
Improper Authentication Level Check in LemonLDAP::NG
CVE: CVE-2024-52946
Component: lemonldap-ng
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Release date: 2024-11-18T00:00:00+00:00

A flaw was found in LemonLDAP::NG. This vulnerability allows an authenticated user to escalate their authentication level via improper handling of session refresh when an "Adaptative authentication rule" is configured with an increment instead of an absolute value.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Compound Document Binary File Sector Allocation Table integer overflow vulnerability
CVE: CVE-2024-42415
Component: libgsf
CWE: CWE-190
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-10-03T15:24:57.874000+00:00

An integer overflow vulnerability was found in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Statement: This vulnerability is classified as important severity rather than moderate due to its potential for arbitrary code execution, which poses a serious security risk. The integer overflow in the sector allocation table leads to a heap-based buffer overflow, allowing an attacker to write beyond the allocated memory bounds. Exploiting this flaw can result in memory corruption, enabling attackers to execute arbitrary code with the privileges of the affected application. Given that the vulnerability can be triggered by merely opening a specially crafted file, this expands the attack surface significantly, making exploitation feasible even through routine user actions like opening documents.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
jfs: Fix shift-out-of-bounds in dbDiscardAG
CVE: CVE-2024-44938
Component: kernel
CWE: CWE-682
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix shift-out-of-bounds in dbDiscardAG

When searching for the next smaller log2 block, BLKSTOL2() returned 0,
causing shift exponent -1 to be negative.

This patch fixes the issue by exiting the loop directly when negative
shift is found.


Remediation:
phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
CVE: CVE-2024-53204
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe

In rtk_usb3phy_probe() devm_kzalloc() may return NULL
but this returned value is not checked.


Remediation:
wifi: iwlwifi: fix a memory corruption
CVE: CVE-2024-26610
Component: kernel
CWE: CWE-680
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2024-02-29T00:00:00+00:00

A memory corruption flaw was found in the Linux kernel Intel Wireless WiFi Next Gen AGN module. This issue could allow a local user to crash the system.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the iwlwifi module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2024-11563
Component: IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2024-11-21T20:48:51.745000+00:00

IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24860.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
CVE: CVE-2024-42101
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-30T00:00:00+00:00

A flaw was found in the Linux kernel’s nouveau module. The return value of the drm_mode_duplicate function is not checked in the nouveau_connector_get_modes function in the drivers/gpu/drm/nouveau/nouveau_connector.c file, possibly causing a NULL pointer dereference and resulting in a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Out of bounds memory access in ANGLE
CVE: CVE-2024-7532
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2024-08-06T00:00:00+00:00

Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
CVE: CVE-2024-47753
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning

Fix a smatch static checker warning on vdec_vp8_req_if.c.
Which leads to a kernel crash when fb is NULL.


Remediation:
btrfs: don&#39;t BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
CVE: CVE-2024-46841
Component: kernel
CWE: CWE-703
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()

We handle errors here properly, ENOMEM isn't fatal, return the error.


Remediation: