huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ksmbd: session race condition remote code execution vulnerability
CVE: CVE-2023-32257
Component: kernel
CWE: CWE-413
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-05-04T00:00:00+00:00

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

Statement: No Red Hat products are affected by this flaw, as the ksmbd code is not included in any shipping kernel release.

Remediation:
soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
CVE: CVE-2023-53744
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

The TI AM33xx power management driver in the Linux kernel fails to release reference counts acquired via wkup_m3_ipc_get() when errors occur during probe. Since the corresponding wkup_m3_ipc_put() call is missing from error paths, repeated probe failures gradually exhaust kernel resources.

Statement: This affects TI AM335x/AM437x SoC platforms running the pm33xx driver. The bug manifests only under error conditions during power management initialization, making real-world impact unlikely for most deployments.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg
CVE: CVE-2023-51779
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-12-25T00:00:00+00:00

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution.

Statement: This flaw has been rated as having a Moderate impact because it is believed to be difficult to exploit and it is not clear whether or not it could be used to achieve local privilege escalation.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Linux kernel: Denial of Service in Xen grant table reclaim via memory leak
CVE: CVE-2023-54081
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xen: speed up grant-table reclaim

When a grant entry is still in use by the remote domain, Linux must put
it on a deferred list.  Normally, this list is very short, because
the PV network and block protocols expect the backend to unmap the grant
first.  However, Qubes OS's GUI protocol is subject to the constraints
of the X Window System, and as such winds up with the frontend unmapping
the window first.  As a result, the list can grow very large, resulting
in a massive memory leak and eventual VM freeze.

To partially solve this problem, make the number of entries that the VM
will attempt to free at each iteration tunable.  The default is still
10, but it can be overridden via a module parameter.

This is Cc: stable because (when combined with appropriate userspace
changes) it fixes a severe performance and stability problem for Qubes
OS users.

Statement: Xen grant table reclaim can accumulate a very large deferred list when a remote domain keeps grant references in use and the local domain cannot end foreign access in time. In such scenarios the deferred list can grow without bounds and cause a massive memory leak that eventually freezes the guest VM. For the CVSS the PR:N choice in the paranoid score assumes an attacker controls a remote domain that interacts with the victim through grant table based protocols and does not require privileges inside the victim OS. It is an inter domain interaction specific to Xen environments and is most relevant for setups like Qubes OS where GUI related behavior can trigger large numbers of deferred grants. Impact is denial of service due to memory exhaustion and VM unresponsiveness.

Remediation:
Out of bounds read in ANGLE
CVE: CVE-2023-1534
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-03-21T00:00:00+00:00

Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/panel: fix a possible null pointer dereference
CVE: CVE-2023-52821
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/panel: fix a possible null pointer dereference

In versatile_panel_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.


Remediation:
net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
CVE: CVE-2023-53733
Component: kernel
CWE: CWE-664
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode

When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter
operation done at u32_set_parms.

Statement: Fix ensures cls_u32 properly unbinds a filter from its class if u32_replace_hw_knode() fails during HW offload. Without the unbind, a dangling bind/reference could persist, leading to inconsistent classifier state, potential reference leaks, or kernel crashes on later updates/removals. Exploitation requires local CAP_NET_ADMIN to manipulate tc u32 rules.

Remediation:
Arbitrary command execution on Windows in vim/vim
CVE: CVE-2023-4736
Component: vim
CWE: CWE-426
Severity: Low
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-09-02T00:00:00+00:00

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.

Statement: This vulnerability does not affect the vim package as shipped in Red Hat Enterprise Linux.

Remediation:
CVE: CVE-2023-42122
Component: Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability
Release date: 2023-09-27T22:21:48.539000+00:00

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-42088
Component: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2023-09-08T16:31:26.976000+00:00

PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22088.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use after free issue in driver/firewire in outbound_phy_packet_callback
CVE: CVE-2023-3159
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free flaw was found in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a use-after-free issue when the queue_event() fails.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
NULL pointer dereference vulnerability in io_uring_show_fdinfo
CVE: CVE-2023-46862
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-10-29T00:00:00+00:00

A null pointer dereference flaw was found in the Linux kernel's io_uring functionality. This issue could allow a local user to crash the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
PCI: Fix use-after-free in pci_bus_release_domain_nr()
CVE: CVE-2023-53363
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free exists in the linux kernel such that The kernel frees the struct pci_bus in pci_remove_bus() (via release_pcibus_dev()).
After the structure is freed, a callback (pci_bus_release_domain_nr()) accesses that freed memory, leading to damage to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use after free in Extensions
CVE: CVE-2023-4366
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-08-15T00:00:00+00:00

Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple CVEs published by Talos
CVE: CVE-2023-37921
Component: gtkwave
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2vzt conversion utility.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds Read while parsing citations
CVE: CVE-2023-42821
Component: gomarkdown-markdown
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-09-22T00:00:00+00:00

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cifs: use-after-free in cifs_demultiplex_thread()
CVE: CVE-2023-52572
Component: kernel
Severity: Moderate
Release date: 2023-01-01T00:00:00+00:00

A use-after-free flaw was found in cifs_demultiplex_thread() in the Linux kernel. This may lead to a crash.

Statement: This flaw was found to be a duplicate of CVE-2023-1192. Please see https://access.redhat.com/security/cve/CVE-2023-1192 for information about affected products and security errata.

Remediation:
access to arbitrary files via directory traversal
CVE: CVE-2023-49294
Component: asterisk
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-12-14T00:00:00+00:00

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Denial of Service with Client Certificates using .NET Kestrel
CVE: CVE-2023-36799
Component: dotnet
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-09-13T00:00:00+00:00

A vulnerability was found in dotnet. This issue can lead to a denial of service when processing X.509 certificates.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2023-39483
Component: PDF-XChange Editor J2K File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2023-08-17T19:01:49.702000+00:00

PDF-XChange Editor J2K File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18308.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ksmbd: Read Request Out-Of-Bounds Read Information Disclosure Vulnerability
CVE: CVE-2023-39179
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.

Statement: No Red Hat products are affected by this CVE, as the ksmbd code is not included in any shipping RHEL kernel release.

Remediation:
CVE: CVE-2023-44449
Component: NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability
Release date: 2023-11-20T20:01:24.638000+00:00

NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the clearAlertByIds function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21875.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HSTS double-free
CVE: CVE-2023-27537
Component: curl
CWE: CWE-415
Severity: Low
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-03-20T00:00:00+00:00

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.


Remediation:
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
CVE: CVE-2023-52437
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's md/raid5 driver, specifically introduced by commit 5e2cf333b7bd. This commit triggers a race condition wherein the system hangs due to improper handling of MD_SB_CHANGE_PENDING flags. During the execution of md_write_start, if MD_SB_CHANGE_PENDING is set and concurrently cleared by raid5d, it can lead to a deadlock situation. This results in system unresponsiveness, potentially causing a denial of service (DoS).

Statement: Red Hat Product Security does not consider this to be a vulnerability.

Remediation:
CVE: CVE-2023-42067
Component: PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2023-09-08T16:27:19.684000+00:00

PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20984.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: double free in btrfs_get_root_ref()
CVE: CVE-2023-4389
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.

Statement: The affected code was not introduced into any kernel versions shipped with Red Hat Enterprise Linux, making this issue not applicable to these platforms.

Remediation: