huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ax25: Fix netdev refcount issue
CVE: CVE-2024-36009
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the Linux kernel's AX.25 protocol implementation. The issue arises from incorrect handling of the netdev reference count, where the `dev_tracker` associated with the AX.25 device is improperly managed. Specifically, the `dev_tracker` of the `ax25_cb` should be deallocated during device detachment in the `ax25_kill_by_device()` function, but it was mistakenly tied to the `ax25_dev`. This mismanagement leads to a reference count mismatch, triggering warnings and potential system instability, as indicated by logs showing already released references.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images
CVE: CVE-2024-49504
Component: grub2
CWE: CWE-276
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-13T14:44:23.659000+00:00

grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.

Statement: This vulnerability doesn't affected any version of grub2 as shipped with any Red Hat product.

Remediation:
nommu: pass NULL argument to vma_iter_prealloc()
CVE: CVE-2024-53109
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nommu: pass NULL argument to vma_iter_prealloc()

When deleting a vma entry from a maple tree, it has to pass NULL to
vma_iter_prealloc() in order to calculate internal state of the tree, but
it passed a wrong argument.  As a result, nommu kernels crashed upon
accessing a vma iterator, such as acct_collect() reading the size of vma
entries after do_munmap().

This commit fixes this issue by passing a right argument to the
preallocation call.


Remediation:
source code disclosure with handlers configured via AddType
CVE: CVE-2024-40725
Component: httpd
CWE: CWE-668
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-07-18T09:32:00+00:00

A flaw was found in httpd. The fix for CVE-2024-39884 ignores some uses of the legacy content-type based configuration of handlers. "AddType" and similar configurations, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Statement: The httpd package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and in Red Hat JBoss Core Services is not affected by this vulnerability because the vulnerable code was introduced in a newer version of httpd.

This flaw allows unauthenticated remote users to view local content that was not intended to be served or shared, such as PHP scripts. As the disclosed information presents a serious impact to confidentiality, this flaw has been rated with an important severity.

Remediation:
InnoDB unspecified vulnerability (CPU Oct 2024)
CVE: CVE-2024-21236
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-15T19:52:47.226000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
s390/cpum_sf: Handle CPU hotplug remove during sampling
CVE: CVE-2024-57849
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

A vulnerability was found in the Linux Kernel. This issue affects performance monitoring on the `s390` architecture during specific CPU hotplug scenarios.

Statement: This vulnerability is marked as Moderate rather than Important because its impact is limited to a specific scenario involving CPU hotplug operations on the `s390` architecture with active performance events. While the issue can lead to a use-after-free condition, the scope of exploitation is constrained since it requires precise timing to interact with deallocated sampling data buffers (SDBs) during event cleanup. Moreover, the invalid memory access primarily affects performance monitoring functionality and does not directly compromise critical system processes or user data.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
MONGO and ZigBee TLV dissector infinite loops
CVE: CVE-2024-4854
Component: wireshark
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-05-15T00:00:00+00:00

A flaw was found in the MONGO and ZigBee TLV dissectors of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
CVE: CVE-2024-49857
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: set the cipher for secured NDP ranging

The cipher pointer is not set, but is derefereced trying to set its
content, which leads to a NULL pointer dereference.
Fix it by pointing to the cipher parameter before dereferencing.


Remediation:
Server: Optimizer unspecified vulnerability (CPU Jan 2024)
CVE: CVE-2024-20974
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-16T00:00:00+00:00

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Stored XSS due to improper sanitization
CVE: CVE-2024-6886
Component: Gitea
CWE: CWE-79
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-07-09T00:00:00+00:00

A flaw was found in Gitea. This issue may allow cross-site scripting (XSS) due to improper input sanitization, which can allow an attacker to inject a malicious script into web pages viewed by other users. To exploit this flaw, an attacker must be able to create a repository with malicious settings or modify the settings of an existing repository.

Statement: This vulnerability is specific to the Gitea server application, which is not shipped or used by any Red Hat products. While some components may use the Gitea Go SDK, the SDK is a client library and is not impacted by this server-side vulnerability.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
CVE: CVE-2024-49912
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'

This commit adds a null check for 'stream_status' in the function
'planes_changed_for_existing_stream'. Previously, the code assumed
'stream_status' could be null, but did not handle the case where it was
actually null. This could lead to a null pointer dereference.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)


Remediation:
Type Confusion in V8
CVE: CVE-2024-11395
Component: chromium-browser
Release date: 2024-11-19T19:11:34.281000+00:00

Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect trust policy behavior for pull requests from forks in Bitbucket Branch Source Plugin
CVE: CVE-2024-28152
Component: jenkins-2-plugins
CWE: CWE-501
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-03-06T00:00:00+00:00

A flaw was found in jenkins-2-plugins. Multibranch Pipelines with a Bitbucket branch source can be configured to discover pull requests from forks. The trust policy is set to "Forks in the same account" by default. In Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, this trust policy allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server. This allows attackers that are able to submit pull requests from forks to change the Pipeline behavior. In Bitbucket Branch Source Plugin 871.v28d74e8b_4226, the "Forks in the same account" trust policy does not extend trust to Jenkinsfiles modified by users without write access to the project.


Remediation:
OOB access in ldap_escape
CVE: CVE-2024-8932
Component: php
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2024-11-22T06:03:29.764000+00:00

A security issue was found in PHP. Uncontrolled long string inputs to the `ldap_escape()` function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. This issue may lead to an application crash or other undefined or unexpected results.

Statement: This vulnerability does not affect the PHP versions as shipped with Red Hat Enterprise Linux 8 and 9 as this flaw affects 32-bit versions of PHP which are not supported by Red Hat.

Remediation:
Ansible Event-Driven Automation (EDA) lacks encryption
CVE: CVE-2024-9620
Component: Event-Driven Automation in Ansible Automation Platform (AAP)
CWE: CWE-319
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-10-08T00:00:00+00:00

A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.


Remediation:
nilfs2: fix kernel bug due to missing clearing of checked flag
CVE: CVE-2024-50230
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel bug due to missing clearing of checked flag

Syzbot reported that in directory operations after nilfs2 detects
filesystem corruption and degrades to read-only,
__block_write_begin_int(), which is called to prepare block writes, may
fail the BUG_ON check for accesses exceeding the folio/page size,
triggering a kernel bug.

This was found to be because the "checked" flag of a page/folio was not
cleared when it was discarded by nilfs2's own routine, which causes the
sanity check of directory entries to be skipped when the directory
page/folio is reloaded.  So, fix that.

This was necessary when the use of nilfs2's own page discard routine was
applied to more than just metadata files.


Remediation:
scsi: qedf: Make qedf_execute_tmf() non-preemptible
CVE: CVE-2024-42124
Component: kernel
CWE: CWE-372
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's qedf driver function qedf_execute_tmf(), where the function call smp_processor_id() is done from preemptible code (before acquiring a lock) which can result in BUG_ON() when running an RT kernel. This can result in system inconsistencies.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm: xlnx: zynqmp_disp: layer may be null while releasing
CVE: CVE-2024-56537
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm: xlnx: zynqmp_disp: layer may be null while releasing

layer->info can be null if we have an error on the first layer in
zynqmp_disp_create_layers


Remediation:
CVE: CVE-2024-11546
Component: IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2024-11-21T20:43:47.921000+00:00

IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24714.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
llc: Drop support for ETH_P_TR_802_2.
CVE: CVE-2024-26635
Component: kernel
CWE: CWE-456
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-03-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

llc: Drop support for ETH_P_TR_802_2.

syzbot reported an uninit-value bug below. [0]

llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2
(0x0011), and syzbot abused the latter to trigger the bug.

  write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16)

llc_conn_handler() initialises local variables {saddr,daddr}.mac
based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes
them to __llc_lookup().

However, the initialisation is done only when skb->protocol is
htons(ETH_P_802_2), otherwise, __llc_lookup_established() and
__llc_lookup_listener() will read garbage.

The missing initialisation existed prior to commit 211ed865108e
("net: delete all instances of special processing for token ring").

It removed the part to kick out the token ring stuff but forgot to
close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().

Let's remove llc_tr_packet_type and complete the deprecation.

[0]:
BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90
 __llc_lookup_established+0xe9d/0xf90
 __llc_lookup net/llc/llc_conn.c:611 [inline]
 llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791
 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206
 __netif_receive_skb_one_core net/core/dev.c:5527 [inline]
 __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641
 netif_receive_skb_internal net/core/dev.c:5727 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5786
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002
 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048
 call_write_iter include/linux/fs.h:2020 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x8ef/0x1490 fs/read_write.c:584
 ksys_write+0x20f/0x4c0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x93/0xd0 fs/read_write.c:646
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Local variable daddr created at:
 llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783
 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206

CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023


Remediation:
Remoce Code Execution vulnerability in torch.distributed.rpc framework
CVE: CVE-2024-5480
Component: python-pytorch
Release date: 2024-06-06T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
memory leak via glutAddSubMenu() function
CVE: CVE-2024-24258
Component: freeglut
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-02-12T00:00:00+00:00

A memory leak flaw was found in the glutAddSubMenu function of freeglut, an open-source alternative to the OpenGL Utility Toolkit. This flaw allows an attacker to launch a denial of service attack by crashing or hanging the program or taking advantage of other unexpected program behavior resulting from a low memory condition.

Statement: The flaw allows an attacker to potentially cause a denial of service attack by crashing a program, but the impact is minimal.

Remediation:
x86/hyperv: fix kexec crash due to VP assist page corruption
CVE: CVE-2024-46864
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-27T00:00:00+00:00

in cpuhp_setup_state() a requisite condition of "hyperv_init_cpuhp > 0" for the hyperv case will never be true, and then hv_cpu_die() won't be called on all CPUs and the VP assist page will not be reset. This leads to corruption of the previous VP assist page and ultimately panic if the kexec kernel is using that memory. The hyperv_init_cpuhp condition should be removed entirely.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Inappropriate implementation in Blink
CVE: CVE-2024-11116
Component: chromium-browser
Release date: 2024-11-12T20:09:27.786000+00:00

Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OOB-read in gst_wavparse_cue_chunk
CVE: CVE-2024-47776
Component: gstreamer1-plugins-good
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2024-12-11T19:16:04.573000+00:00

A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.


Remediation:
aws-2020: Random Number Generator of Ada is not cryptographically secure
CVE: CVE-2024-41708
Component: aws
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-09-25T17:15:18.823000+00:00

An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple vulnerabilities
CVE: CVE-2024-6306
Component: wordpress
Release date: 2024-06-25T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation: