huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
drm/i915/gvt: fix vgpu debugfs clean in remove
CVE: CVE-2023-53625
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A NULL pointer dereference was found in the Linux kernel Intel i915 graphics driver's virtual GPU debugfs cleanup handling. 
A local user with privileges to unbind the i915 driver can trigger driver removal on systems with active virtual GPU instances, causing the cleanup path to attempt removing debugfs entries after the debugfs root has already been destroyed, which results in a NULL pointer dereference and denial of service through kernel crash.

Statement: The issue arises because of incorrect ordering in the driver removal sequence. When the i915 driver with GVT-g (GPU virtualization) support is unbound, the cleanup proceeds through multiple stages: driver removal, MDEV (mediated device) unregistration, and vGPU destruction. During vGPU destruction, the code unconditionally calls intel_gvt_debugfs_remove_vgpu() to clean up debugfs entries. However, at this point in the removal sequence, the DRM minor's debugfs root may have already been torn down. When debugfs_remove() attempts to lock the inode semaphore to recursively remove entries, it dereferences a NULL pointer (address 0x150, an offset into the destroyed debugfs inode structure), causing an immediate kernel oops. This occurs reliably on any system using GVT-g when the driver is unbound while virtual GPUs exist. The impact is strictly availability—the system crashes during driver removal. There is no memory corruption, information disclosure, or path to privilege escalation; the NULL dereference happens in lock acquisition code before any potentially dangerous operations could occur.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the kvmgt module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
HV: hv_balloon: fix memory leak with using debugfs_lookup()
CVE: CVE-2023-52937
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HV: hv_balloon: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c
CVE: CVE-2023-52464
Component: kernel
CWE: CWE-805
Severity: Low
CVSS v3: 3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux Kernel. An improper buffer size is provided to the strncat function, which may result in an out-of-bounds write, leading to memory corruption or a denial of service.

Statement: Because the functions in question pass as arguments static strings with a known size, none of which exceed the size of the allocated buffer, this flaw is not known to be exploitable under any supported scenario.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available.
multiple vulnerabilitites
CVE: CVE-2023-50009
Component: ffmpeg
Release date: 2023-01-01T00:00:00+00:00

FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
bpf: Annotate bpf_long_memcpy with data_race
CVE: CVE-2023-52521
Component: kernel
CWE: CWE-362
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

bpf: Annotate bpf_long_memcpy with data_race

The Linux kernel CVE team has assigned CVE-2023-52521 to this issue.

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2024030519-REJECTED-22f6@gregkh/

Remediation:
memory corruption via immutable objects
CVE: CVE-2023-23931
Component: python-cryptography
CWE: CWE-754
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2023-02-08T00:00:00+00:00

A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such as `bytes`) to be mutated, thus violating the fundamental rules of Python, resulting in corrupted output.


Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Double-free in process spawning on Windows
CVE: CVE-2023-5174
Component: Mozilla
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-09-26T00:00:00+00:00

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.*

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Memory corruption in OCB handling
CVE: CVE-2023-36660
Component: nettle
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-06-26T00:00:00+00:00

A vulnerability was found in Nettle. The issue occurs in the new Offset Code Book (OCB) code and may cause a denial of service or other problems, leading to memory corruption.


Remediation:
caif: fix memory leak in cfctrl_linkup_request()
CVE: CVE-2023-53330
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

caif: fix memory leak in cfctrl_linkup_request()

When linktype is unknown or kzalloc failed in cfctrl_linkup_request(),
pkt is not released. Add release process to error path.


Remediation:
Linux kernel: Denial of Service due to deadlock in Universal Flash Storage driver
CVE: CVE-2023-53760
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a deadlock vulnerability in the Universal Flash Storage (UFS) host controller driver (ufshcd). This occurs when the error handler and a Command Queue (CQ) event interrupt attempt to acquire the same lock simultaneously. Successful exploitation leads to a system deadlock, causing a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
tty: n_gsm: fix race condition in status line change on dead connections
CVE: CVE-2023-52872
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: fix race condition in status line change on dead connections

gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all
timers, removing the virtual tty devices and clearing the data queues.
This procedure, however, may cause subsequent changes of the virtual modem
status lines of a DLCI. More data is being added the outgoing data queue
and the deleted kick timer is restarted to handle this. At this point many
resources have already been removed by the cleanup procedure. Thus, a
kernel panic occurs.

Fix this by proving in gsm_modem_update() that the cleanup procedure has
not been started and the mux is still alive.

Note that writing to a virtual tty is already protected by checks against
the DLCI specific connection state.


Remediation:
audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability
CVE: CVE-2023-51589
Component: bluez
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found within the handling of the AVRCP protocol in BlueZ. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.


Remediation:
Linux kernel: Denial of Service via NULL pointer dereference in blk-cgroup
CVE: CVE-2023-54271
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's block cgroup (blk-cgroup) component. A local attacker could exploit a race condition in the `blkcg_activate_policy()` function, where block group policy data (`blkg_policy_data`) is installed before it is fully initialized. This allows another function, `ioc_weight_write()`, to access uninitialized data, leading to a NULL pointer dereference and causing a system crash, resulting in a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
missing mmap_lock in file_files_note that could possibly lead to a use after free in the coredump code
CVE: CVE-2023-1249
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected.

Statement: This flaw is challenging to execute, as the attacker must race the vulnerable code twice. Therefore it is considered Low severity.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Type Confusion in V8
CVE: CVE-2023-2936
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-05-30T00:00:00+00:00

Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
amd: RyzenTM Master provide a null value access leading to denial of service
CVE: CVE-2023-20560
Component: hw
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-08-08T06:30:00+00:00

Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD RyzenTM Master may allow a privileged attacker to provide a null value, potentially resulting in a Windows crash, leading to denial of service.


Remediation:
Please contact AMD support for updates.
Stored XSS vulnerability in Pipeline: Build Step Plugin
CVE: CVE-2023-25762
Component: jenkins-2-plugins/pipeline-build-step
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2023-02-15T00:00:00+00:00

A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting (XSS) vulnerability that may allow attackers to control job names.

Statement: OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support, therefore, the OpenShift 3.11 Jenkins component is marked as out of support scope in this CVE.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
heap buffer overflow in xls_parseWorkBook() in xls.c
CVE: CVE-2023-38853
Component: libxls
CVSS v3: 0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Release date: 2023-08-15T00:00:00+00:00

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015.

Statement: This flaw was found to be a duplicate of CVE-2023-38852. Please see https://access.redhat.com/security/cve/CVE-2023-38852 for information about affected products and security errata.

Remediation:
speculative pointer dereference in do_prlimit() in kernel/sys.c
CVE: CVE-2023-0458
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-01-21T00:00:00+00:00

A vulnerabilty was found in Linux Kernel, where a speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument
CVE: CVE-2023-44271
Component: python-pillow
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-06-30T00:00:00+00:00

A flaw was found in Pillow. A denial of service issue uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for TrueType in ImageFont when text length in an ImageDraw instance operates on a long text argument.

Statement: This security vulnerability is categorized as having a moderate impact because it only results in increased memory consumption when exceptionally long strings are utilized as text input.

Remediation:
Red Hat Ansible Automation Platform
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in CORS
CVE: CVE-2023-2465
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-05-02T00:00:00+00:00

Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-50232
Component: Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability
Release date: 2023-01-01T00:00:00+00:00

Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server.

The specific flaw exists within the getParams method. The issue results from the lack of proper validation of a user-supplied string before using it to prepare an argument for a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22028.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
CVE: CVE-2023-53808
Component: kernel
CWE: CWE-771
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix memory leak in mwifiex_histogram_read()

Always free the zeroed page on return from 'mwifiex_histogram_read()'.


Remediation:
Reflected XSS in Queue Endpoint
CVE: CVE-2023-50727
Component: resque
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Release date: 2023-12-19T00:00:00+00:00

A cross-site scripting flaw was found in Resque due to improper validation of user-supplied input by the Queue Endpoint. This issue could allow a remote authenticated attacker to use a specially crafted URL to execute script in a victim's web browser within the security context of the hosting web site once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.


Remediation:
Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023)
CVE: CVE-2023-22048
Component: mysql
Severity: Low
CVSS v3: 3.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2023-07-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Excessive disk usage during file upload
CVE: CVE-2023-41835
Component: struts
CWE: CWE-913
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-12-05T00:00:00+00:00

A flaw was found in struts. When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in 'struts.multipart.saveDir', even if the request has been denied.

Statement: This issue only affects Struts 2 and newer, which is not shipped in any Red Hat Products.

Remediation: