huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
netfs: Fix netfs_page_mkwrite() to check folio-->mapping is valid
CVE: CVE-2024-41083
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-29T00:00:00+00:00

A flaw was found in `netfs_page_mkwrite()` in the Linux kernel caused by a missing validation check for `folio->mapping` after acquiring the folio lock. This oversight could lead to a NULL pointer dereference, resulting in kernel crashes when handling file operations. The issue arose from interference by `invalidate_inode_pages2_range()` during Direct I/O (DIO) writes.

Statement: Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SNORE Interface Unauthenticated Remote Code Execution
CVE: CVE-2024-6198
Component: Viasat firmware
Release date: 2024-01-01T00:00:00+00:00

The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker
with access to the LAN network interface could use a specially crafted HTTP request to exploit a buffer overflow on the modem.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
CVE: CVE-2024-26852
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-04-17T00:00:00+00:00

A use-after-free flaw was found in ip6_route_mpath_notify() in the Linux kernel. This may lead to a crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2024-6032
Component: Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
Release date: 2024-01-01T00:00:00+00:00

Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability.
 
The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
CVE: CVE-2024-53051
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability

Sometimes during hotplug scenario or suspend/resume scenario encoder is
not always initialized when intel_hdcp_get_capability add
a check to avoid kernel null pointer dereference.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
net: af_can: do not leave a dangling sk pointer in can_create()
CVE: CVE-2024-56603
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: af_can: do not leave a dangling sk pointer in can_create()

On error can_create() frees the allocated sk object, but sock_init_data()
has already attached it to the provided sock object. This will leave a
dangling sk pointer in the sock object and may cause use-after-free later.

Statement: This issue is considered to be a moderate impact flaw. It seems the data exposed in this case is specific to network protocol stack and not of all kernel space.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
CVE: CVE-2024-57911
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

The 'data' array is allocated via kmalloc() and it is used to push data
to user space from a triggered buffer, but it does not set values for
inactive channels, as it only uses iio_for_each_active_channel()
to assign new values.

Use kzalloc for the memory allocation to avoid pushing uninitialized
information to userspace.


Remediation:
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
CVE: CVE-2024-27039
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

An erroneous devm_kfree() flaw was found in the Linux kernel in drivers/clk/hisilicon/clk-hi3559a.c. This issue may lead to a crash.


Remediation:
mlxbf_gige: call request_irq() after NAPI initialized
CVE: CVE-2024-35907
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-19T00:00:00+00:00

CVE-2024-35907 is a vulnerability in the Linux kernel's mlxbf_gige driver, which supports Mellanox BlueField devices. The issue occurs during kdump operations when a receive (RX) interrupt is triggered before the driver fully initializes. This leads to a race condition that can result in a NULL pointer dereference, causing the system to crash.

A pending RX interrupt before the driver requests the IRQ can lead to an improper sequence of operations, resulting in the crash.

This flaw affects system stability during kdump operations, potentially causing kernel panics.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
mm/hugetlb: do not call vma_add_reservation upon ENOMEM
CVE: CVE-2024-39477
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: do not call vma_add_reservation upon ENOMEM

sysbot reported a splat [1] on __unmap_hugepage_range().  This is because
vma_needs_reservation() can return -ENOMEM if
allocate_file_region_entries() fails to allocate the file_region struct
for the reservation.

Check for that and do not call vma_add_reservation() if that is the case,
otherwise region_abort() and region_del() will see that we do not have any
file_regions.

If we detect that vma_needs_reservation() returned -ENOMEM, we clear the
hugetlb_restore_reserve flag as if this reservation was still consumed, so
free_huge_folio() will not increment the resv count.

[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa


Remediation:
crafted malformed file can lead to memory corruption due to heap overflow
CVE: CVE-2024-22391
Component: gdcm
CVSS v3: 7.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Release date: 2024-04-25T00:00:00+00:00

A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
denial of service when handling a request with many HTTP headers
CVE: CVE-2024-37890
Component: nodejs-ws
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-16T00:00:00+00:00

A flaw was found in the Node.js WebSocket library (ws). A request with several headers exceeding the 'server.maxHeadersCount' threshold could be used to crash a ws server, leading to a denial of service.


Remediation:
To install the Red Hat Developer Hub 1.3, follow the instructions linked from the References section.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.
The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0.
drm/amdkfd: Fix lock dependency warning
CVE: CVE-2024-26628
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-03-06T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix lock dependency warning

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/20240320164818.3778843-2-lee@kernel.org/

Remediation:
f2fs: multidev: fix to recognize valid zero block address
CVE: CVE-2024-38636
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-21T00:00:00+00:00

A vulnerability was found in the Flash-Friendly File System (F2FS) in the Linux kernel, where the system failed to correctly recognize valid zero block addresses in multi-device configurations. This issue could potentially lead to improper handling of data or file system errors.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
heap-buffer-overflow in Vim
CVE: CVE-2024-45306
Component: vim
CWE: CWE-122
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2024-09-02T18:15:36.920000+00:00

A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was unnecessary. However, this change made it possible for the cursor position to stay invalid and point beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Since Red Hat Enterprise Linux 6, 7 are Out-of-Support-Scope for Low/Moderate flaws, the issue is not currently planned to be addressed in future updates for RHEL-6,7. Only Important and Critical severity flaws will be addressed at this time.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
ice: Fix improper extts handling
CVE: CVE-2024-42139
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's ethernet ice driver, where EXTTS events are improperly handled. If the driver is removed while the managing application is running, certain EXTT events might remain enabled. This issue can lead to system instability and crashes.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/dpaa2: Avoid explicit cpumask var allocation on stack
CVE: CVE-2024-42093
Component: kernel
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2024-07-29T00:00:00+00:00

A potential stack overflow flaw was found in the Linux kernel’s DPAA2 ethernet driver. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: Red Hat Enterprise Linux not affected.

To successfully exploit this bug, an attacker must be able to access sensitive data from kernel memory — like secrets, credentials, or system state.

But this bug is:

* A stack overflow (not a read or leak),
* Occurring inside a kernel driver during internal processing,
* With no known exploit that leaks data from memory.
So unless it can be exploited to leak data, C:L is more appropriate.

Remediation:
regulator: axp20x: AXP717: set ramp_delay
CVE: CVE-2024-53682
Component: kernel
Severity: None
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

regulator: axp20x: AXP717: set ramp_delay

AXP717 datasheet says that regulator ramp delay is 15.625 us/step,
which is 10mV in our case.

Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to
expand to AXP_DESC_RANGES_DELAY with ramp_delay = 0

For DCDC4, steps is 100mv

Add a AXP_DESC_DELAY macro and update AXP_DESC macro to
expand to AXP_DESC_DELAY with ramp_delay = 0

This patch fix crashes when using CPU DVFS.


Remediation:
InnoDB unspecified vulnerability (CPU Apr 2024)
CVE: CVE-2024-21047
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-16T00:00:00+00:00

A flaw was found in the MySQL Server product of Oracle MySQL (component: InnoDB). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation:
broken access control when setting calendar event type
CVE: CVE-2024-33996
Component: moodle
Release date: 2024-05-20T04:00:00+00:00

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple CVEs
CVE: CVE-2024-29162
Component: hdf5
Severity: Moderate
Release date: 2024-05-10T00:00:00+00:00

HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG_read, resulting in denial of service or potential code execution.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
drm/amdgpu: don't access invalid sched
CVE: CVE-2024-46896
Component: kernel
CWE: CWE-119
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: don't access invalid sched

Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
accessing job->base.sched can produce unexpected results as the initialisation
of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
memset.

This commit fixes an issue when a CS would fail validation and would
be rejected after job->num_ibs is incremented. In this case,
amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
machine because the ring value is bogus.

To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
because the device is actually not used in this function.

The next commit will remove the ring argument completely.

(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)


Remediation:
memory leak
CVE: CVE-2024-24750
Component: undici
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-02-16T00:00:00+00:00

An uncontrolled resource consumption flaw was found in undici. Calling `fetch(url)` and not consuming the incoming body or consuming it very slowly leads to a memory leak.

Statement: Users unable to upgrade should make sure to always consume the incoming body.

Remediation:
CVE: CVE-2024-30343
Component: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-03-28T12:38:28.815000+00:00

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22721.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Apache Traffic Server: Intercept plugins are not access controlled
CVE: CVE-2024-56195
Component: trafficserver
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-01-01T00:00:00+00:00

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Thread Pooling unspecified vulnerability (CPU Apr 2024)
CVE: CVE-2024-21102
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-16T00:00:00+00:00

A flaw was found in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation: