huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ipc: fix to protect IPCS lookups using RCU
CVE: CVE-2025-38212
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipc: fix to protect IPCS lookups using RCU

syzbot reported that it discovered a use-after-free vulnerability, [0]

[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/

idr_for_each() is protected by rwsem, but this is not enough.  If it is
not protected by RCU read-critical region, when idr_for_each() calls
radix_tree_node_free() through call_rcu() to free the radix_tree_node
structure, the node will be freed immediately, and when reading the next
node in radix_tree_for_each_slot(), the already freed memory may be read.

Therefore, we need to add code to make sure that idr_for_each() is
protected within the RCU read-critical region when we call it in
shm_destroy_orphaned().


Remediation:
wifi: iwlwifi: mvm: don't try to talk to a dead firmware
CVE: CVE-2025-21930
Component: kernel
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't try to talk to a dead firmware

This fixes:

 bad state = 0
 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 [iwlwifi]
 Call Trace:
  <TASK>
  ? __warn+0xca/0x1c0
  ? iwl_trans_send_cmd+0xba/0xe0 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4]
  iwl_fw_dbg_clear_monitor_buf+0xd7/0x110 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4]
  _iwl_dbgfs_fw_dbg_clear_write+0xe2/0x120 [iwlmvm 0e8adb18cea92d2c341766bcc10b18699290068a]

Ask whether the firmware is alive before sending a command.


Remediation:
HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests
CVE: CVE-2025-48956
Component: vllm
CWE: CWE-130
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-26T14:51:41.716000+00:00

A flaw was found in vLLM. A denial of service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large X-Forwarded-For header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user.

Statement: This vulnerability is considered Important rather than just Moderate because it enables a complete denial of service with minimal effort from a remote, unauthenticated attacker. Unlike moderate flaws that might require specific conditions, partial access, or complex exploitation chains, here a single oversized HTTP request is sufficient to exhaust server memory and crash the vLLM service. Since vLLM is often deployed as a backend for high-availability inference workloads, this creates a high-impact risk: availability is entirely compromised, all running workloads are disrupted, and recovery may require manual intervention. The lack of authentication barriers makes the attack surface fully exposed over the network, which elevates the severity beyond Moderate to Important.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2025:19427
For more information visit https://access.redhat.com/errata/RHSA-2025:19429
For more information visit https://access.redhat.com/errata/RHSA-2025:19424
For more information visit https://access.redhat.com/errata/RHSA-2025:19430
For more information visit https://access.redhat.com/errata/RHSA-2025:19426
For more information visit https://access.redhat.com/errata/RHSA-2025:19422
For more information visit https://access.redhat.com/errata/RHSA-2025:19428
For more information visit https://access.redhat.com/errata/RHSA-2025:19425
For more information visit https://access.redhat.com/errata/RHSA-2025:19421
For more information visit https://access.redhat.com/errata/RHSA-2025:19423
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Until a fix is available, the risk can be reduced by running vLLM behind a reverse proxy such as Nginx, Envoy, or HAProxy with strict header size limits, ensuring that oversized requests are dropped before reaching the service. Additional safeguards like container or VM resource limits and traffic monitoring can help contain the impact, but upgrading to the patched release remains the definitive solution.
cmd/go: Local code execution and arbitrary file write via malicious module version strings
CVE: CVE-2025-68119
Component: cmd/go
CWE: CWE-78
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Golang's cmd/go module. This vulnerability allows a local attacker to achieve local code execution by downloading and building modules with specially crafted malicious version strings. On systems with Mercurial (hg) installed, this can occur when downloading modules from non-standard sources due to how external Version Control System (VCS) commands are constructed. Additionally, on systems with Git installed, providing malicious version strings to the toolchain can enable an attacker to write to arbitrary files on the filesystem. This issue is triggered by explicitly supplying these malicious version strings.

Statement: This issue is rated Moderate severity by Red Hat Product Security, because exploitation requires non-standard and intentional user behavior. 

The attacker must explicitly supply a specially crafted module version string, which does not occur during normal Go module usage such as @latest or standard module paths, making the attack complexity high. 

Additionally, user interaction is required, as the vulnerable behavior is only triggered when a user manually invokes the Go toolchain to download or build the malicious module.
 
While successful exploitation can result in local code execution or arbitrary file modification, the combination of local access, manual input, and uncommon usage patterns significantly limits the likelihood of exploitation in typical environments.

Remediation:
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
gnuplot segmentation fault on plot3d_points
CVE: CVE-2025-31176
Component: gnuplot
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.

Statement: This flaw is rated as a Moderate impact as the attacker or malicious user must be local and the impact is restricted to availability.

Remediation:
Currently, no mitigation is available for this vulnerability.
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
CVE: CVE-2025-40035
Component: kernel
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-10-28T00:00:00+00:00

An information disclosure flaw was found in the Linux kernel's uinput driver in the force feedback upload handling for 32-bit compatibility mode. A local user can trigger this issue by performing force feedback upload operations through the uinput device, where uninitialized padding bytes in the uinput_ff_upload_compat structure are copied to userspace. This leaks kernel stack memory contents to unprivileged users.

Statement: The uinput driver provides a userspace interface for creating virtual input devices with force feedback support. When handling FF_UPLOAD requests in 32-bit compatibility mode, the driver constructs a uinput_ff_upload_compat structure on the stack. This structure embeds ff_effect_compat twice, which contains internal padding bytes for alignment (notably after struct ff_replay before a union member). The code populates the valid fields but leaves padding uninitialized. When copy_to_user() transfers the entire structure, these padding bytes expose whatever stack data happened to occupy that memory. While the leaked data is limited in size and content is unpredictable, it could potentially reveal kernel pointers or other sensitive information useful for defeating KASLR or further exploitation.

Remediation:
To mitigate this issue, prevent the uinput module from being loaded if virtual input devices are not required. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
RISC-V: KVM: fix stack overrun when loading vlenb
CVE: CVE-2025-39815
Component: kernel
Severity: None
Release date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: fix stack overrun when loading vlenb

The userspace load can put up to 2048 bits into an xlen bit stack
buffer.  We want only xlen bits, so check the size beforehand.


Remediation:
fs/ntfs3: Add sanity check for file name
CVE: CVE-2025-38707
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add sanity check for file name

The length of the file name should be smaller than the directory entry size.


Remediation:
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE: CVE-2025-21176
Component: dotnet
CWE: CWE-126
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-14T18:04:00.852000+00:00

A remote code execution vulnerability was found in .NET. This flaw allows an attacker to load a specially crafted file in .NET.

Statement: This issue affects .NET Framework as shipped with all versions of RHEL. However, this flaw is not known to be exploitable under any supported scenario.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Twig fixes a security issue where escaping was missing when using null coalesce operator (??)
CVE: CVE-2025-24374
Component: php-twig
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-01-29T15:22:34.012000+00:00

A flaw was found in Twig. This issue may allow output escaping bypass via the ?? operator when processing the left-hand expression.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
CVE: CVE-2025-68230
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix gpu page fault after hibernation on PF passthrough

On PF passthrough environment, after hibernate and then resume, coralgemm
will cause gpu page fault.

Mode1 reset happens during hibernate, but partition mode is not restored
on resume, register mmCP_HYP_XCP_CTL and mmCP_PSP_XCP_CTL is not right
after resume. When CP access the MQD BO, wrong stride size is used,
this will cause out of bound access on the MQD BO, resulting page fault.

The fix is to ensure gfx_v9_4_3_switch_compute_partition() is called
when resume from a hibernation.
KFD resume is called separately during a reset recovery or resume from
suspend sequence. Hence it's not required to be called as part of
partition switch.

(cherry picked from commit 5d1b32cfe4a676fe552416cb5ae847b215463a1a)


Remediation:
python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
CVE: CVE-2025-61912
Component: python-ldap
CWE: CWE-170
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-10T22:04:25.028000+00:00

A vulnerability exists in the python-ldap's ldap.dn.escape_dn_chars() helper function, where the null byte (\x00) is improperly escaped by emitting a backslash followed by a literal NUL instead of the required RFC 4514 hex form \00. When this helper is used on untrusted input to build LDAP distinguished names (DNs), it may cause a client-side failure, before any communication with the LDAP server occurs. This results in a client side denial of service (DoS) for parts of the application that rely on the helper for DN construction.

Statement: Availability impact is considered Low, as the flaw is limited to denial of service (client-side) only.

```
It is important to note that the python-ldap3 package (https://github.com/cannatag/ldap3) is entirely separate and not affected. Only the python-ldap package (https://github.com/python-ldap/python-ldap) contains the vulnerable implementation.
```

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond these steps.
CVE: CVE-2025-7988
Component: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-07-22T18:00:47.250000+00:00

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25862.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in ANGLE
CVE: CVE-2025-10502
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-24T16:17:13.365000+00:00

A Heap based buffer overflow issue has been ientified in ANGLE in Google Chrome that allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OpenEXR: Remote Code Execution via malicious EXR file parsing
CVE: CVE-2025-12495
Component: OpenEXR
CWE: CWE-122
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:41:27.753000+00:00

A flaw was found in OpenEXR, a library for handling High Dynamic Range (HDR) image files. This heap-based buffer overflow vulnerability allows a remote attacker to execute arbitrary code on a user's system. This occurs when a user is tricked into opening a specially crafted EXR file, exploiting a weakness in how the software processes image data. Successful exploitation could lead to complete control over the affected system.

Statement: This vulnerability is rated Important for Red Hat as it allows remote code execution when a user opens a specially crafted EXR file.

Remediation:
To mitigate this issue, users should exercise caution and avoid opening untrusted EXR files. As exploitation requires user interaction with a malicious file, preventing the opening of such files will prevent exploitation.
CVE: CVE-2025-15350
Component: Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2025-12-30T14:04:32.398000+00:00

Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27039.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: xhci: Don't skip on Stopped - Length Invalid
CVE: CVE-2025-22023
Component: kernel
CWE: CWE-755
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Don't skip on Stopped - Length Invalid

Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are
returned when isoc ring is stopped") in v6.11, the driver didn't skip
missed isochronous TDs when handling Stoppend and Stopped - Length
Invalid events. Instead, it erroneously cleared the skip flag, which
would cause the ring to get stuck, as future events won't match the
missed TD which is never removed from the queue until it's cancelled.

This buggy logic seems to have been in place substantially unchanged
since the 3.x series over 10 years ago, which probably speaks first
and foremost about relative rarity of this case in normal usage, but
by the spec I see no reason why it shouldn't be possible.

After d56b0b2ab142, TDs are immediately skipped when handling those
Stopped events. This poses a potential problem in case of Stopped -
Length Invalid, which occurs either on completed TDs (likely already
given back) or Link and No-Op TRBs. Such event won't be recognized
as matching any TD (unless it's the rare Link TRB inside a TD) and
will result in skipping all pending TDs, giving them back possibly
before they are done, risking isoc data loss and maybe UAF by HW.

As a compromise, don't skip and don't clear the skip flag on this
kind of event. Then the next event will skip missed TDs. A downside
of not handling Stopped - Length Invalid on a Link inside a TD is
that if the TD is cancelled, its actual length will not be updated
to account for TRBs (silently) completed before the TD was stopped.

I had no luck producing this sequence of completion events so there
is no compelling demonstration of any resulting disaster. It may be
a very rare, obscure condition. The sole motivation for this patch
is that if such unlikely event does occur, I'd rather risk reporting
a cancelled partially done isoc frame as empty than gamble with UAF.

This will be fixed more properly by looking at Stopped event's TRB
pointer when making skipping decisions, but such rework is unlikely
to be backported to v6.12, which will stay around for a few years.


Remediation:
CVE: CVE-2025-3532
Component: YouDianCMS index.html.Attackers cross site scripting
Release date: 2025-04-13T06:00:10.234000+00:00

A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
userinfo leakage in URI#join, URI#merge and URI#+
CVE: CVE-2025-27221
Component: uri
CWE: CWE-212
Severity: Low
CVSS v3: 3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2025-03-03T00:00:00+00:00

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak can occur.


Remediation:
OpenSSL: Denial of Service via malformed PKCS#12 file processing
CVE: CVE-2025-69421
Component: openssl
CWE: CWE-476
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by providing a specially crafted, malformed PKCS#12 file to an application that processes it. The flaw occurs due to a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function when handling the malformed file, leading to an application crash.

Statement: This vulnerability is rated Low for Red Hat because it requires an application to process a specially crafted, malformed PKCS#12 file, leading to a Denial of Service. The vulnerability is limited to a crash and cannot be escalated to achieve code execution or memory disclosure. Red Hat FIPS modules are not affected as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.