huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Cpython infinite loop when parsing a tarfile
CVE: CVE-2025-8194
Component: cpython
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-28T18:42:44.847000+00:00

A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module.

Statement: To exploit this issue, an attacker needs to be able to process a specially crafted tar archive with a Python application using the tarfile module. Furthermore, this vulnerability will cause a denial of service with no other security impact.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
For more information visit https://access.redhat.com/errata/RHSA-2025:19427
For more information visit https://access.redhat.com/errata/RHSA-2025:19429
For more information visit https://access.redhat.com/errata/RHSA-2025:19424
For more information visit https://access.redhat.com/errata/RHSA-2025:19430
For more information visit https://access.redhat.com/errata/RHSA-2025:19426
For more information visit https://access.redhat.com/errata/RHSA-2025:19422
For more information visit https://access.redhat.com/errata/RHSA-2025:19428
For more information visit https://access.redhat.com/errata/RHSA-2025:19425
For more information visit https://access.redhat.com/errata/RHSA-2025:19421
For more information visit https://access.redhat.com/errata/RHSA-2025:19423
This flaw can be mitigated by adding the following code after importing the tarfile module ("import tarfile"):

~~~
import tarfile

def _block_patched(self, count):
    if count < 0:  # pragma: no cover
        raise tarfile.InvalidHeaderError("invalid offset")
    return _block_patched._orig_block(self, count)

_block_patched._orig_block = tarfile.TarInfo._block
tarfile.TarInfo._block = _block_patched
~~~
CVE: CVE-2025-7261
Component: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:57:19.791000+00:00

IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26130.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cups-filters: cups-filters: Out-of-bounds write via crafted PDF MediaBox
CVE: CVE-2025-64503
Component: cups
CWE: CWE-787
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-12T22:04:03.750000+00:00

A flaw was found in cups-filters. This vulnerability allows an out-of-bounds write via a crafted Portable Document Format (PDF) file with a large MediaBox value.

Statement: This vulnerability is rated Moderate for Red Hat Enterprise Linux because a specially crafted PDF file, when processed by the `cups-filters` `pdftoraster` tool, can lead to an out-of-bounds write, potentially causing a denial of service. This affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Fedora.

Remediation:
End-of-Life Node.js Versions Pose Security Risks 19.x
CVE: CVE-2025-23088
Component: nodejs
CWE: CWE-1104
Severity: None
Release date: 2025-01-22T01:11:30.829000+00:00

A flaw was found in Node.js. This vulnerability allows potential exposure to unaddressed software vulnerabilities via the continued use of End-of-Life (EOL) versions that no longer receive security updates or patches.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Red Hat Enterprise Linux is not impacted by this CVE, as it does not include or ship any End-of-Life (EOL) versions of Node.js in its supported repositories. Red Hat ensures that all components provided in its distributions are actively maintained and receive necessary updates, including security patches, to mitigate vulnerabilities and maintain system security.

Remediation:
drm/radeon: Do not kfree() devres managed rdev
CVE: CVE-2025-68170
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Do not kfree() devres managed rdev

Since the allocation of the drivers main structure was changed to
devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling
kfree() on it.

This fixes things exploding if the driver probe fails and devres cleans up
the rdev after we already free'd it.

(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)


Remediation:
HID: pidff: Fix null pointer dereference in pidff_find_fields
CVE: CVE-2025-37862
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: pidff: Fix null pointer dereference in pidff_find_fields

This function triggered a null pointer dereference if used to search for
a report that isn't implemented on the device. This happened both for
optional and required reports alike.

The same logic was applied to pidff_find_special_field and although
pidff_init_fields should return an error earlier if one of the required
reports is missing, future modifications could change this logic and
resurface this possible null pointer dereference again.

LKML bug report:
https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com


Remediation:
privilege escalation via excessive /etc/passwd permissions
CVE: CVE-2025-58712
Component: amq
CWE: CWE-276
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-07T14:26:00+00:00

A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Statement: Red Hat Product Security has rated this vulnerability as moderate severity for affected products which run on OpenShift. The vulnerability allows for potential privilege escalation within a container, but OpenShift's default, multi-layered security posture effectively mitigates this risk. 

The primary controls include the default Security Context Constraints (SCC), which severely limit a container's permissions from the start, and SELinux, which enforces mandatory access control to ensure strict isolation. While other container runtime environments may have different controls available and require case-by-case analysis, OpenShift's built-in defenses are designed to prevent this type of attack.

Out of Box RHEL configuration isolates a single process inside a container. Unless multiple processes are packaged inside a single container, that defeats the principle behind containerization, this bug can not be used to meaningfully escalate privileges.

Also, RHEL, and any common linux distributions do NOT add any additional users to the root group. The presence of the root group is strictly due to conformance with POSIX permission management requirements and can be considered to be an artifact of filesystem permission limitations.

Remediation:
To update to the latest image please refer to the AMQ container images in the Red Hat Container catalog.
Artifex Ghostscript: Denial of Service via crafted document processing
CVE: CVE-2025-59800
Component: Artifex Ghostscript
CWE: CWE-190
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-22T00:00:00+00:00

A flaw was found in Artifex Ghostscript. An integer overflow vulnerability, which occurs when a program attempts to store a number in an integer variable that is too small to hold it, leads to a heap-based buffer overflow. This allows a local attacker to cause a Denial of Service (DoS) by processing a specially crafted document.

Statement: This vulnerability is rated Moderate for Red Hat products. An integer overflow in Artifex Ghostscript's OCR processing, specifically in `ocr_begin_page`, can lead to a heap-based buffer overflow. This flaw could be triggered by processing a specially crafted document, potentially resulting in denial of service or arbitrary code execution.

Remediation:
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
CVE: CVE-2025-71185
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation

Make sure to drop the reference taken when looking up the crossbar
platform device during am335x route allocation.


Remediation:
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
CVE: CVE-2025-38040
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: mctrl_gpio: split disable_ms into sync and no_sync APIs

The following splat has been observed on a SAMA5D27 platform using
atmel_serial:

BUG: sleeping function called from invalid context at kernel/irq/manage.c:738
in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name: kworker/u5:0
preempt_count: 1, expected: 0
INFO: lockdep is turned off.
irq event stamp: 0
hardirqs last  enabled at (0): [<00000000>] 0x0
hardirqs last disabled at (0): [<c01588f0>] copy_process+0x1c4c/0x7bec
softirqs last  enabled at (0): [<c0158944>] copy_process+0x1ca0/0x7bec
softirqs last disabled at (0): [<00000000>] 0x0
CPU: 0 UID: 0 PID: 27 Comm: kworker/u5:0 Not tainted 6.13.0-rc7+ #74
Hardware name: Atmel SAMA5
Workqueue: hci0 hci_power_on [bluetooth]
Call trace:
  unwind_backtrace from show_stack+0x18/0x1c
  show_stack from dump_stack_lvl+0x44/0x70
  dump_stack_lvl from __might_resched+0x38c/0x598
  __might_resched from disable_irq+0x1c/0x48
  disable_irq from mctrl_gpio_disable_ms+0x74/0xc0
  mctrl_gpio_disable_ms from atmel_disable_ms.part.0+0x80/0x1f4
  atmel_disable_ms.part.0 from atmel_set_termios+0x764/0x11e8
  atmel_set_termios from uart_change_line_settings+0x15c/0x994
  uart_change_line_settings from uart_set_termios+0x2b0/0x668
  uart_set_termios from tty_set_termios+0x600/0x8ec
  tty_set_termios from ttyport_set_flow_control+0x188/0x1e0
  ttyport_set_flow_control from wilc_setup+0xd0/0x524 [hci_wilc]
  wilc_setup [hci_wilc] from hci_dev_open_sync+0x330/0x203c [bluetooth]
  hci_dev_open_sync [bluetooth] from hci_dev_do_open+0x40/0xb0 [bluetooth]
  hci_dev_do_open [bluetooth] from hci_power_on+0x12c/0x664 [bluetooth]
  hci_power_on [bluetooth] from process_one_work+0x998/0x1a38
  process_one_work from worker_thread+0x6e0/0xfb4
  worker_thread from kthread+0x3d4/0x484
  kthread from ret_from_fork+0x14/0x28

This warning is emitted when trying to toggle, at the highest level,
some flow control (with serdev_device_set_flow_control) in a device
driver. At the lowest level, the atmel_serial driver is using
serial_mctrl_gpio lib to enable/disable the corresponding IRQs
accordingly.  The warning emitted by CONFIG_DEBUG_ATOMIC_SLEEP is due to
disable_irq (called in mctrl_gpio_disable_ms) being possibly called in
some atomic context (some tty drivers perform modem lines configuration
in regions protected by port lock).

Split mctrl_gpio_disable_ms into two differents APIs, a non-blocking one
and a blocking one. Replace mctrl_gpio_disable_ms calls with the
relevant version depending on whether the call is protected by some port
lock.


Remediation:
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
CVE: CVE-2025-40288
Component: kernel
Severity: None
Release date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices

Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
but that `man->bdev` (the backing device pointer within the manager) remains
uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
a kernel OOPS.

1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
   `amdgpu_cs_get_threshold_for_moves()` to include a check for
   `ttm_resource_manager_used()`. If the manager is not used (uninitialized
   `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
   logic that would trigger the NULL dereference.

2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
   reporting to use a conditional: if the manager is used, return the real VRAM
   usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
   NULL.

3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
   data write path. Use `ttm_resource_manager_used()` to check validity: if the
   manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
   `fb_usage` to 0 (APUs have no discrete framebuffer to report).

This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized
  `man->bdev` and pass the `ttm_resource_manager_used()` check).

v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)


Remediation:
drm/msm: Fix a fence leak in submit error path
CVE: CVE-2025-38410
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix a fence leak in submit error path

In error paths, we could unref the submit without calling
drm_sched_entity_push_job(), so msm_job_free() will never get
called.  Since drm_sched_job_cleanup() will NULL out the
s_fence, we can use that to detect this case.

Patchwork: https://patchwork.freedesktop.org/patch/653584/


Remediation:
Linux kernel: Denial of Service in USB-audio MIDI driver due to improper timer shutdown
CVE: CVE-2025-38105
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Kill timer properly at removal

The USB-audio MIDI code initializes the timer, but in a rare case, the
driver might be freed without the disconnect call.  This leaves the
timer in an active state while the assigned object is released via
snd_usbmidi_free(), which ends up with a kernel warning when the debug
configuration is enabled, as spotted by fuzzer.

For avoiding the problem, put timer_shutdown_sync() at
snd_usbmidi_free(), so that the timer can be killed properly.
While we're at it, replace the existing timer_delete_sync() at the
disconnect callback with timer_shutdown_sync(), too.


Remediation:
io_uring/rw: ensure allocated iovec gets cleared for early failure
CVE: CVE-2025-40267
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: ensure allocated iovec gets cleared for early failure

A previous commit reused the recyling infrastructure for early cleanup,
but this is not enough for the case where our internal caches have
overflowed. If this happens, then the allocated iovec can get leaked if
the request is also aborted early.

Reinstate the previous forced free of the iovec for that situation.


Remediation:
can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated
CVE: CVE-2025-21774
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated

Fix NULL pointer check in rkcanfd_handle_rx_fifo_overflow_int() to
bail out if skb cannot be allocated.


Remediation:
usb: gadget : fix use-after-free in composite_dev_cleanup()
CVE: CVE-2025-38555
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget : fix use-after-free in composite_dev_cleanup()

1. In func configfs_composite_bind() -> composite_os_desc_req_prepare():
if kmalloc fails, the pointer cdev->os_desc_req will be freed but not
set to NULL. Then it will return a failure to the upper-level function.
2. in func configfs_composite_bind() -> composite_dev_cleanup():
it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it
will attempt to use it.This will lead to a use-after-free issue.

BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0
Read of size 8 at addr 0000004827837a00 by task init/1

CPU: 10 PID: 1 Comm: init Tainted: G           O      5.10.97-oh #1
 kasan_report+0x188/0x1cc
 __asan_load8+0xb4/0xbc
 composite_dev_cleanup+0xf4/0x2c0
 configfs_composite_bind+0x210/0x7ac
 udc_bind_to_driver+0xb4/0x1ec
 usb_gadget_probe_driver+0xec/0x21c
 gadget_dev_desc_UDC_store+0x264/0x27c

Statement: A use-after-free in the USB gadget composite framework occurs on a bind-failure path: if allocation in composite_os_desc_req_prepare() fails, cdev->os_desc_req is freed but not nulled, and subsequent composite_dev_cleanup() will dereference the stale pointer. Exploitation requires the system to be running in USB gadget mode and a privileged user (e.g., via configfs/sysfs) to bind a gadget/UDC; the likely outcome is a kernel crash (DoS), with theoretical UAF misuse risk. The fix sets cdev->os_desc_req = NULL after freeing to prevent the double use.
PR:H applies because triggering this flaw requires privileged access to configure or bind USB gadget drivers via configfs/sysfs, which is not available to unprivileged users.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-8655
Component: Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability
Release date: 2025-08-06T01:14:25.616000+00:00

Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26314.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
CVE: CVE-2025-30165
Component: vllm
CWE: CWE-502
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-06T06:30:00+00:00

A flaw was found in vLLM's multi-node configuration, which is vulnerable to remote code execution due to unsafe deserialization using pickle over a ZeroMQ SUB socket. If the primary vLLM host is compromised, attackers can escalate privileges and execute arbitrary code on connected secondary hosts.

Statement: No Red Hat products are affected by these vulnerabilities.

These vulnerabilities are marked as high severity due to their direct impact on security and data confidentiality in multi-node vLLM deployments.The use of unsafe deserialization with pickle over a ZeroMQ SUB socket allows an attacker to execute arbitrary code remotely. If the primary vLLM node is compromised, this flaw can be used to escalate privileges and execute malicious code on secondary hosts, impacting the entire deployment. This lack of input validation and the insecure use of serialization mechanisms significantly increase the exploitability of this issue, leading to its classification as a high severity vulnerability.

In RHOAI, vLLM is not included by default in RHOAI deployment as an operator or controller . Hence, RHOAI is not-affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Hibernate Reactive: Denial of Service due to connection leak on HTTP client disconnect
CVE: CVE-2025-14969
Component: hibernate-reactive-core
CWE: CWE-772
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-19T00:00:00+00:00

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection pool, potentially causing a Denial of Service (DoS) by exhausting available database connections.

Statement: This vulnerability is rated Moderate for Red Hat Build of Quarkus. When an application built with Quarkus 3.27 uses Hibernate Reactive and exposes an HTTP endpoint for database operations, a remote client can cause an application level denial of service by prematurely closing the HTTP connection, leading to database connection pool exhaustion. Other Red Hat products, including Enterprise Application Platform and Red Hat OpenShift Dev Spaces, are not affected as the vulnerable code is not present.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.