huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
wifi: nl80211: Avoid address calculations via out of bounds array indexing
CVE: CVE-2024-38562
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-06-19T00:00:00+00:00

A vulnerability has been identified in the Linux kernel, specifically involving a possible out-of-bounds array indexing within the net/wireless/nl80211.c file (related to the wireless networking subsystem). This flaw can lead to a kernel-level crash, resulting in a denial-of-service condition for the affected system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
CVE: CVE-2024-41011
Component: kernel
CWE: CWE-119
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-07-18T00:00:00+00:00

A flaw was found in the Linux Kernel's AMD Kernel Fusion Driver when mapping the MMIO HDP page with large pages. This issue could allow a local user to gain unauthorized access to memory.

Statement: Red Hat Enterprise Linux not affected.

Remediation:
buffer overflow in Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format
CVE: CVE-2024-28562
Component: freeimage
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-03-20T00:00:00+00:00

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
CVE: CVE-2024-26985
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

A buffer overflow leak was found in intel_fb_bo_framebuffer_init in the Linux kernel that can cause a crash.

Statement: Red Hat has protection mechanisms in place against buffer overflows such as FORTIFY_SOURCE, Position Independent Executables, or Stack Smashing Protection.

Remediation:
Remove root certificates from `GLOBALTRUST` from the root store
CVE: CVE-2024-39689
Component: python-certifi
CWE: CWE-345
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-07-03T00:00:00+00:00

A flaw was found in Certifi, a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certain versions of Certifi recognized root certificates from 'GLOBALTRUST'. However, pursuant to an investigation that identified "long-running and unresolved compliance issues," GLOBALTRUST's root certificates are now removed from the root store.

Statement: Red Hat ships an affected version of python-certifi; however, the product includes a separate CA bundle installed from RHEL with a custom product-based patch. Hence it is not using the certificates provided upstream and not affected by the flaw. Red Hat Product Security team does not foresee any impact on the confidentiality, integrity or availability of system for this product due to this flaw.

Remediation:
This issue can be mitigated by adding the root CAs in question to /etc/pki/ca-trust/source/blacklist on RHEL 8 or /etc/pki/ca-trust/source/blocklist on RHEL 9 and running update-ca-trust.

See also https://www.redhat.com/sysadmin/configure-ca-trust-list.
fsdax: dax_unshare_iter needs to copy entire blocks
CVE: CVE-2024-50250
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2024-11-09T00:00:00+00:00

A buffer overrun exists in the Linux kernel. When pos and len are passed to dax_file_unshare, they are not aligned to an fsblock boundary, and the iteration of pos and length in the _iter function will reflect this.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Improper Authorization For Topic-Level Policy Management
CVE: CVE-2024-28098
Component: apache-pulsar
CWE: CWE-863
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2024-03-12T00:00:00+00:00

A flaw was found in Apache Pulsar. This issue allows a non-tenant user to modify permissions for sensitive configurations, impacting data integrity and confidentiality.

Statement: Apache Pulsar is not part of EAP - it's not present in the EAP dependency tree and not distributed in the product maven repository. EAP is not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Golang FIPS zeroed buffer
CVE: CVE-2024-9355
Component: golang-fips
CWE: CWE-457
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2024-09-30T20:53:42.833000+00:00

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Statement: This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
usb: typec: ucsi: Move unregister out of atomic section
CVE: CVE-2024-46691
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Move unregister out of atomic section

Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock
non-sleeping")' moved the pmic_glink client list under a spinlock, as it
is accessed by the rpmsg/glink callback, which in turn is invoked from
IRQ context.

This means that ucsi_unregister() is now called from atomic context,
which isn't feasible as it's expecting a sleepable context. An effort is
under way to get GLINK to invoke its callbacks in a sleepable context,
but until then lets schedule the unregistration.

A side effect of this is that ucsi_unregister() can now happen
after the remote processor, and thereby the communication link with it, is
gone. pmic_glink_send() is amended with a check to avoid the resulting NULL
pointer dereference.
This does however result in the user being informed about this error by
the following entry in the kernel log:

  ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5


Remediation:
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
CVE: CVE-2024-47829
Component: pnpm
CWE: CWE-328
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in the pnpm package manager. In the affected versions, the path shortening function utilizes the MD5 hashing algorithm for compressing paths. If a collision occurs, this can lead to two different libraries being stored in the same path. Although the real names of these libraries are stored under the package name in the /node_modules/ directory, the version numbers for the libraries are not included.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2024-8817
Component: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2024-09-17T16:23:45.693000+00:00

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24212.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
CVE: CVE-2024-42282
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's Mediatek network driver. Previously, if `alloc_netdev_dummy()` failed in `mtk_probe()`, the error handling code might attempt to free a NULL `dummy_dev`, leading to a crash.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
CVE: CVE-2024-56691
Component: kernel
Severity: None
Release date: 2024-12-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device

While design wise the idea of converting the driver to use
the hierarchy of the IRQ chips is correct, the implementation
has (inherited) flaws. This was unveiled when platform_get_irq()
had started WARN() on IRQ 0 that is supposed to be a Linux
IRQ number (also known as vIRQ).

Rework the driver to respect IRQ domain when creating each MFD
device separately, as the domain is not the same for all of them.


Remediation:
mailbox: th1520: Fix memory corruption due to incorrect array size
CVE: CVE-2024-57983
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mailbox: th1520: Fix memory corruption due to incorrect array size

The functions th1520_mbox_suspend_noirq and th1520_mbox_resume_noirq are
intended to save and restore the interrupt mask registers in the MBOX
ICU0. However, the array used to store these registers was incorrectly
sized, leading to memory corruption when accessing all four registers.

This commit corrects the array size to accommodate all four interrupt
mask registers, preventing memory corruption during suspend and resume
operations.


Remediation:
i2c: i801: Fix block process call transactions
CVE: CVE-2024-26593
Component: kernel
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-02-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Fix block process call transactions

According to the Intel datasheets, software must reset the block
buffer index twice for block process call transactions: once before
writing the outgoing data to the buffer, and once again before
reading the incoming data from the buffer.

The driver is currently missing the second reset, causing the wrong
portion of the block buffer to be read.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module i2c-i801 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
CVE: CVE-2024-51504
Component: org.apache.zookeeper
CWE: CWE-290
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-11-07T09:52:03.957000+00:00

An authentication bypass vulnerability was found in Apache Zookeeper. The default configuration of the client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication by spoofing the client's IP address in request headers. The default configuration honors the X-Forwarded-For HTTP header to read the client's IP address, which can be easily spoofed by an attacker pretending that the request came from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily, can be executed on successful exploitation, potentially leading to information leakage or service availability issues.

Statement: This vulnerability is considered an Important severity because it allows an attacker to bypass authentication by spoofing the client’s IP address, exploiting a weakness in ZooKeeper Admin Server's reliance on the `X-Forwarded-For` HTTP header for IP-based authentication. Unlike moderate vulnerabilities that might require additional conditions for exploitation, this flaw directly exposes critical admin commands—such as snapshot and restore—without requiring complex attack vectors. Successful exploitation can lead to unauthorized execution of sensitive commands, resulting in potential information leakage, data integrity risks, and service availability issues.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
JS - Crash on empty HTTP server response
CVE: CVE-2024-42328
Component: zabbix
Release date: 2024-11-27T12:04:53.864000+00:00

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ACPI: CPPC: Use access_width over bit_width for system memory accesses
CVE: CVE-2024-35995
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the ACPI subsystem's CPPC driver in the Linux kernel. This issue occurs due to the mishandling of memory access bit width during performance capability calculations, which can lead to misaligned memory accesses and cause kernel panics on affected platforms.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
pinctrl: ocelot: fix system hang on level based interrupts
CVE: CVE-2024-50196
Component: kernel
CWE: CWE-754
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: ocelot: fix system hang on level based interrupts

The current implementation only calls chained_irq_enter() and
chained_irq_exit() if it detects pending interrupts.

```
for (i = 0; i < info->stride; i++) {
	uregmap_read(info->map, id_reg + 4 * i, &reg);
	if (!reg)
		continue;

	chained_irq_enter(parent_chip, desc);
```

However, in case of GPIO pin configured in level mode and the parent
controller configured in edge mode, GPIO interrupt might be lowered by the
hardware. In the result, if the interrupt is short enough, the parent
interrupt is still pending while the GPIO interrupt is cleared;
chained_irq_enter() never gets called and the system hangs trying to
service the parent interrupt.

Moving chained_irq_enter() and chained_irq_exit() outside the for loop
ensures that they are called even when GPIO interrupt is lowered by the
hardware.

The similar code with chained_irq_enter() / chained_irq_exit() functions
wrapping interrupt checking loop may be found in many other drivers:
```
grep -r -A 10 chained_irq_enter drivers/pinctrl
```


Remediation:
openlink virtuoso-opensource: Denial of Service via crafted SQL statements
CVE: CVE-2024-57653
Component: virtuoso-opensource
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

An issue in the qst_vec_set_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.


Remediation:
Inappropriate implementation in iOS
CVE: CVE-2024-2630
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2024-03-19T00:00:00+00:00

Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
powerpc/kasan: Limit KASAN thread size increase to 32KB
CVE: CVE-2024-26710
Component: kernel
CWE: CWE-121
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel due to improper stack size incrementation logic for KASAN-enabled builds, which in turn could cause kernel panics, build errors, or system instability.

Statement: None of the products shipped by Red Hat are affected by this vulnerability.

Remediation:
Network restriction bypass via race condition during namespace termination
CVE: CVE-2024-7598
Component: kube-apiserver
CWE: CWE-362
Severity: Low
CVSS v3: 3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in Kubernetes. This vulnerability can allow a malicious or compromised pod to bypass network restrictions via the deletion of network policies before pod termination during namespace deletion.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
xen: netfront: Backend can crash Linux netfront (Xen Security Advisory 465)
CVE: CVE-2024-53240
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.5/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2024-12-17T12:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: fix crash when removing device

When removing a netfront device directly after a suspend/resume cycle
it might happen that the queues have not been setup again, causing a
crash during the attempt to stop the queues another time.

Fix that by checking the queues are existing before trying to stop
them.

This is XSA-465 / CVE-2024-53240.

Statement: Only systems with non-trusted network backends are vulnerable.

As far as known only Linux guests with the fix for CVE-2022-48969 applied
are vulnerable (this includes all kernel versions from 6.1 onwards)

Remediation:
thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
CVE: CVE-2024-42144
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-30T00:00:00+00:00

A possible NULL pointer dereference on lvts_data was found in the Linux kernel in thermal/drivers/mediatek/lvts_thermal. This may lead to a crash.

Statement: No Red Hat products are affected by this vulnerability.

Remediation: