huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
x86/bpf: Fix IP after emitting call depth accounting
CVE: CVE-2024-35903
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/bpf: Fix IP after emitting call depth accounting

Adjust the IP passed to `emit_patch` so it calculates the correct offset
for the CALL instruction if `x86_call_depth_emit_accounting` emits code.
Otherwise we will skip some instructions and most likely crash.


Remediation:
USB: gadget: dummy-hcd: Fix "task hung" problem
CVE: CVE-2024-50100
Component: kernel
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: dummy-hcd: Fix "task hung" problem

The syzbot fuzzer has been encountering "task hung" problems ever
since the dummy-hcd driver was changed to use hrtimers instead of
regular timers.  It turns out that the problems are caused by a subtle
difference between the timer_pending() and hrtimer_active() APIs.

The changeover blindly replaced the first by the second.  However,
timer_pending() returns True when the timer is queued but not when its
callback is running, whereas hrtimer_active() returns True when the
hrtimer is queued _or_ its callback is running.  This difference
occasionally caused dummy_urb_enqueue() to think that the callback
routine had not yet started when in fact it was almost finished.  As a
result the hrtimer was not restarted, which made it impossible for the
driver to dequeue later the URB that was just enqueued.  This caused
usb_kill_urb() to hang, and things got worse from there.

Since hrtimers have no API for telling when they are queued and the
callback isn't running, the driver must keep track of this for itself.
That's what this patch does, adding a new "timer_pending" flag and
setting or clearing it at the appropriate times.


Remediation:
Out-of-bounds write error may lead to Denial of Service
CVE: CVE-2024-37894
Component: squid
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2024-06-25T00:00:00+00:00

A flaw was found in Squid. An out-of-bounds write can be triggered when an Edge Side Includes (ESI) variable is assigned to a value not in the standard ASCII range, for example, multi-byte characters. This flaw allows a trusted server to crash Squid while processing an ESI response content, resulting in a denial of service.

Statement: Squid as shipped in Red Hat Enterprise Linux 8 and 9 is vulnerable to this vulnerability as the ESI support is enabled by default.

This flaw requires Squid to be in a reverse proxy configuration and using an ESI variable with non ASCII characters, allowing a trusted server to cause a denial of service. For these reasons, this flaw was rated with a Moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension
CVE: CVE-2024-39473
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension

If a process module does not have base config extension then the same
format applies to all of it's inputs and the process->base_config_ext is
NULL, causing NULL dereference when specifically crafted topology and
sequences used.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
arbitrary Lisp code is evaluated as part of turning on Org mode
CVE: CVE-2024-30202
Component: emacs
CWE: CWE-95
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-03-25T00:00:00+00:00

A flaw was found in Emacs. Arbitrary Lisp code can be evaluated when an Org mode file is opened or when the Org mode is being enabled, resulting in arbitrary code execution.

Statement: The Emacs package, as shipped in Red Hat Enterprise Linux 8 and 9, is not affected by this vulnerability because the vulnerable code was introduced in a newer version of Emacs.

To exploit this flaw, an attacker needs to trick a user into opening a crafted Org mode file. For this reason, this flaw has been rated with a Moderate security impact.

Remediation:
Do not open Org mode files from untrusted sources.
vfio/pci: fix potential memory leak in vfio_intx_enable()
CVE: CVE-2024-38632
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Release date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: fix potential memory leak in vfio_intx_enable()

If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
CVE: CVE-2024-45302
Component: restsharp
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-08-29T22:15:05.377000+00:00

A flaw was found in RestSharp. If an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF injection.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TCP: SnailLoad timing side channel in TCP
CVE: CVE-2024-39920
Component: kernel
CWE: CWE-385
Severity: Moderate
CVSS v3: 4.2/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-07-03T06:11:00+00:00

A flaw was found in the TCP protocol in RFC 9293. The TCP protocol has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server) when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue.


Remediation:
EDK2: Information Disclosure and Privilege Escalation via Local BIOS Access
CVE: CVE-2024-38798
Component: EDK2
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.9/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in EDK2. This vulnerability allows information disclosure or escalation of privilege via local access to the BIOS (Basic Input/Output System).

Statement: This vulnerability is rated Moderate for Red Hat as it requires local access to the system. The flaw in EDK2, a BIOS component, could lead to information disclosure or escalation of privilege by an attacker with local access. This primarily affects the underlying hardware firmware.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
CVE: CVE-2024-27894
Component: apache-pulsar
CWE: CWE-552
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2024-03-12T00:00:00+00:00

A vulnerability was found in Apache Pulsar's ability to create functions through URL schemes. When retrieving the function implementation contained in the URL, Pulsar fails to limit access to some privileged resources. As a result, this flaw allows an attacker to gain access to sensitive information such as secrets, access to remote HTTP and HTTPS endpoints data, and possibly cause a denial of service. This vulnerability also affects Pulsar Broker deployments with the flag "functionsWorkerEnabled=true".

Statement: Apache Pulsar is not part of EAP - it's not present in the EAP dependency tree and not distributed in the product maven repository. EAP is not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
iommufd: Fix iopt_access_list_id overwrite bug
CVE: CVE-2024-26786
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix iopt_access_list_id overwrite bug

The Linux kernel CVE team has assigned CVE-2024-26786 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040459-CVE-2024-26786-802f@gregkh/T


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Out of bounds write in Streams API
CVE: CVE-2024-5499
Component: chromium
Release date: 2024-05-31T00:00:00+00:00

Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ALSA: emux: improve patch ioctl data validation
CVE: CVE-2024-42097
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-29T00:00:00+00:00

A missed validation flaw was found in the Linux Kernel's MIDI sequencer and router support functionality. This issue could allow a local user to crash the system.


Remediation:
unprivileged user can configure logid daemon via an unrestricted D-Bus service
CVE: CVE-2024-45752
Component: logiops
CVSS v3: 7.3/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2024-09-19T16:15:04.910000+00:00

logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an unrestricted D-Bus service, including setting malicious keyboard macros. This allows for privilege escalation with minimal user interaction.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
compiler-induced side channel in lib/utils/donna128.h
CVE: CVE-2024-50383
Component: botan
Release date: 2024-10-23T00:00:00+00:00

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
s390/sclp: Fix sclp_init() cleanup on failure
CVE: CVE-2024-41068
Component: kernel
CWE: CWE-372
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/sclp: Fix sclp_init() cleanup on failure

If sclp_init() fails it only partially cleans up: if there are multiple
failing calls to sclp_init() sclp_state_change_event will be added several
times to sclp_reg_list, which results in the following warning:

------------[ cut here ]------------
list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10.
WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3
Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8)
           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
...
Call Trace:
 [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8
([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8)
 [<000003ffe0a8d37e>] sclp_init+0x40e/0x450
 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0
 [<000003ffe15b77a6>] do_initcalls+0x126/0x150
 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8
 [<000003ffe0d6650e>] kernel_init+0x2e/0x180
 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60
 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30

Fix this by removing sclp_state_change_event from sclp_reg_list when
sclp_init() fails.


Remediation:
wxWebSession resp. wxWebRequest crashes on localhost
CVE: CVE-2024-58249
Component: wxWidgets
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-01-01T00:00:00+00:00

In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: sparx5: Fix use after free inside sparx5_del_mact_entry
CVE: CVE-2024-26856
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: sparx5: Fix use after free inside sparx5_del_mact_entry

Based on the static analyzis of the code it looks like when an entry
from the MAC table was removed, the entry was still used after being
freed. More precise the vid of the mac_entry was used after calling
devm_kfree on the mac_entry.
The fix consists in first using the vid of the mac_entry to delete the
entry from the HW and after that to free it.


Remediation:
Remote code execution within ping script
CVE: CVE-2024-22116
Component: zabbix
CVSS v3: 9.6/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2024-08-12T00:00:00+00:00

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nilfs2: fix potential deadlock with newly created symlinks
CVE: CVE-2024-50229
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential deadlock with newly created symlinks

Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers
memory reclamation involving the filesystem layer, which can result in
circular lock dependencies among the reader/writer semaphore
nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the
fs_reclaim pseudo lock.

This is because after commit 21fc61c73c39 ("don't put symlink bodies in
pagecache into highmem"), the gfp flags of the page cache for symbolic
links are overwritten to GFP_KERNEL via inode_nohighmem().

This is not a problem for symlinks read from the backing device, because
the __GFP_FS flag is dropped after inode_nohighmem() is called.  However,
when a new symlink is created with nilfs_symlink(), the gfp flags remain
overwritten to GFP_KERNEL.  Then, memory allocation called from
page_symlink() etc.  triggers memory reclamation including the FS layer,
which may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can
cause a deadlock if they are called while nilfs->ns_segctor_sem is held:

Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags
of newly created symlinks in the same way that nilfs_new_inode() and
__nilfs_read_inode() do, as a workaround until we adopt nofs allocation
scope consistently or improve the locking constraints.


Remediation:
Server: Optimizer unspecified vulnerability (CPU Jan 2024)
CVE: CVE-2024-20982
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-16T00:00:00+00:00

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
wifi: iwlwifi: mvm: fix 6 GHz scan construction
CVE: CVE-2024-53055
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix 6 GHz scan construction

If more than 255 colocated APs exist for the set of all
APs found during 2.4/5 GHz scanning, then the 6 GHz scan
construction will loop forever since the loop variable
has type u8, which can never reach the number found when
that's bigger than 255, and is stored in a u32 variable.
Also move it into the loops to have a smaller scope.

Using a u32 there is fine, we limit the number of APs in
the scan list and each has a limit on the number of RNR
entries due to the frame size. With a limit of 1000 scan
results, a frame size upper bound of 4096 (really it's
more like ~2300) and a TBTT entry size of at least 11,
we get an upper bound for the number of ~372k, well in
the bounds of a u32.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
CVE: CVE-2024-57915
Component: kernel
CWE: CWE-476
Severity: None
Release date: 2024-01-01T00:00:00+00:00

[REJECTED CVE] A vulnerability in the Linux kernel's USB gadget subsystem allowed a race condition where gserial_disconnect could clear gser->ioport during unbinding, leading to a null pointer dereference in gs_read_complete, potentially causing a kernel crash. An attacker could exploit this by repeatedly triggering gadget reconfiguration, leading to denial of service. This issue has been resolved by disabling the endpoint before setting the port to null, preventing access to freed resources.

Statement: This CVE has been rejected upstream:
https://lore.kernel.org/linux-cve-announce/2025021308-REJECTED-3f47@gregkh/

Red Hat has also evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations. 

As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.

If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.

Remediation:
vulnerable to a heap-based Buffer Overflow in yaml_document_add_sequence in api.c
CVE: CVE-2024-35329
Component: libyaml
CWE: CWE-119
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2024-06-11T00:00:00+00:00

A vulnerability was found in libyaml 0.2.5. This issue is caused by a heap-based buffer overflow in yaml_document_add_sequence in api.c.

Statement: Red Hat Product Security does not consider this to be a vulnerability.

Remediation:
multiple vulnerabilities
CVE: CVE-2024-37314
Component: nextcloud
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-06-14T00:00:00+00:00

Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vp_vdpa: fix id_table array not null terminated error
CVE: CVE-2024-53110
Component: kernel
CWE: CWE-170
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vp_vdpa: fix id_table array not null terminated error

Allocate one extra virtio_device_id as null terminator, otherwise
vdpa_mgmtdev_get_classes() may iterate multiple times and visit
undefined memory.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
CVE: CVE-2024-36913
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

In CoCo VMs it is possible for the untrusted host to cause
set_memory_encrypted() or set_memory_decrypted() to fail such that an
error is returned and the resulting memory is shared. Callers need to
take care to handle these errors to avoid returning decrypted (shared)
memory to the page allocator, which could lead to functional or security
issues.

VMBus code could free decrypted pages if set_memory_encrypted()/decrypted()
fails. Leak the pages if this happens.


Remediation: