huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ocfs2: fix data corruption after failed write
CVE: CVE-2023-53081
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix data corruption after failed write

When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page.  This can
leave dirty page beyond EOF and if page writeback tries to write this page
before write succeeds and expands i_size, page gets into inconsistent
state where page dirty bit is clear but buffer dirty bits stay set
resulting in page data never getting written and so data copied to the
page is lost.  Fix the problem by invalidating page beyond EOF after
failed write.


Remediation:
driver core: fix resource leak in device_add()
CVE: CVE-2023-53594
Component: kernel
CWE: CWE-771
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A reference leak was found in the Linux kernel's driver core device registration logic. When kobject_add fails partway through device_add, the error cleanup attempts to free resources but fails because kobject_add has already cleared the device's parent pointer. This prevents cleanup_glue_dir from finding and releasing the glue directory's reference, causing permanent resource leaks that accumulate with repeated failures and eventually lead to denial of service.

Statement: The device_add function is the core device registration mechanism in Linux. It creates various sysfs structures, including "glue directories" that organize devices within the sysfs hierarchy. The flow looks like this: get_device_parent creates or finds a glue directory (incrementing its reference), sets dev->kobj.parent to point to it, then calls kobject_add to register the device kobject in sysfs. If kobject_add succeeds, everything's fine. But if it fails, it has a side effect: it sets dev->kobj.parent to NULL. The error cleanup then calls get_glue_dir to retrieve the glue directory so it can decrement the reference via cleanup_glue_dir. However, with dev->kobj.parent now NULL, get_glue_dir can't find the glue directory and returns NULL itself. cleanup_glue_dir checks for NULL and does nothing. The glue directory reference acquired earlier is never released.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX
CVE: CVE-2023-54251
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was addressed in the Linux kernel’s traffic scheduling (TAPRIO) subsystem. The code that handles the TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME attribute did not enforce an upper bound on this value, which could allow excessively large cycle time inputs to be processed. Under certain conditions, this can lead to an integer overflow or wraparound in the scheduling logic. As a result, the kernel may behave unexpectedly and could be made to crash, resulting in a denial of service condition on affected systems.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cross site scripting vulnerability
CVE: CVE-2023-28873
Component: seafile
Release date: 2023-12-09T00:00:00+00:00

An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-35742
Component: D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-08-25T21:25:01.292000+00:00

D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20069.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
.NET Kestrel: Denial of Service processing X509 Certificates
CVE: CVE-2023-29331
Component: dotnet
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-06-14T00:00:00+00:00

A vulnerability was found in dotnet. This issue can lead to a denial of service while processing X509 Certificates.


Remediation:
find_exif_tag SEGV
CVE: CVE-2023-49463
Component: libheif
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-11-23T00:00:00+00:00

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
CVE: CVE-2023-34153
Component: ImageMagick
CWE: CWE-77
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-05-29T00:00:00+00:00

A vulnerability was found in ImageMagick. This issue may allow shell command injection via video:vsync or video:pixel-format options in VIDEO encoding/decoding.


Remediation:
Redis SORT_RO may bypass ACL configuration
CVE: CVE-2023-41053
Component: redis
CWE: CWE-269
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2023-09-06T00:00:00+00:00

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Remediation:
Use-after-free bug in DestroyWindow
CVE: CVE-2023-5380
Component: xorg-x11-server
CWE: CWE-416
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-10-25T00:00:00+00:00

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

Statement: The xorg-x11-server-Xwayland package as shipped by Red Hat Enterprise Linux 8 and 9 is not affected by this issue as Xwayland does not support multiple protocol screens and is not affected by this vulnerability.

Remediation:
integer overflow may lead to crash
CVE: CVE-2023-7217
Component: libebml
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

An integer overflow vulnerability was found in libebml. The function MemIOCallback::read at line 70 does not restrict the integer size, which could potentially lead to a crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
permission model improperly protects against path traversal
CVE: CVE-2023-39331
Component: nodejs
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-10-13T00:00:00+00:00

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.


Remediation:
CVE: CVE-2023-50212
Component: D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability
Release date: 2023-12-20T10:44:27.160000+00:00

D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper handling of error conditions. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-21664.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free bug in remove function xgene_hwmon_remove
CVE: CVE-2023-1855
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-03-10T10:30:00+00:00

A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.

Statement: Because this flaw affects a specific CPU family, and because exploitation requires elevated system privileges, Red Hat assesses the impact of this flaw as Low.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
This flaw can be mitigated by preventing the affected APM X-Gene SoC HW monitor kernel driver (apm_xgene) from loading during the boot time. Ensure the module is added into the blacklist file.
~~~
Refer:  
How do I blacklist a kernel module to prevent it from loading automatically? 
https://access.redhat.com/solutions/41278
~~~
Auto-populated H5P author name causes a potential information leak
CVE: CVE-2023-5545
Component: moodle
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2023-10-16T00:00:00+00:00

H5P metadata automatically populated the author with the user's username, which could be sensitive information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
malicious role archive can cause ansible-galaxy to overwrite arbitrary files
CVE: CVE-2023-5115
Component: Ansible
CWE: CWE-36
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Release date: 2023-09-21T19:33:00+00:00

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.


Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
virtio-net: stack buffer overflow in virtio_net_flush_tx()
CVE: CVE-2023-6693
Component: QEMU
CWE: CWE-121
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Incorrect use of send buffer can cause memory to be sent to peer
CVE: CVE-2023-46850
Component: openvpn
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-11-10T00:00:00+00:00

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/sched: Check scheduler work queue before calling timeout handling
CVE: CVE-2023-53351
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Check scheduler work queue before calling timeout handling

During an IGT GPU reset test we see again oops despite of
commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before calling
timeout handling).

It uses ready condition whether to call drm_sched_fault which unwind
the TDR leads to GPU reset.
However it looks the ready condition is overloaded with other meanings,
for example, for the following stack is related GPU reset :

0  gfx_v9_0_cp_gfx_start
1  gfx_v9_0_cp_gfx_resume
2  gfx_v9_0_cp_resume
3  gfx_v9_0_hw_init
4  gfx_v9_0_resume
5  amdgpu_device_ip_resume_phase2

does the following:
	/* start the ring */
	gfx_v9_0_cp_gfx_start(adev);
	ring->sched.ready = true;

The same approach is for other ASICs as well :
gfx_v8_0_cp_gfx_resume
gfx_v10_0_kiq_resume, etc...

As a result, our GPU reset test causes GPU fault which calls unconditionally gfx_v9_0_fault
and then drm_sched_fault. However now it depends on whether the interrupt service routine
drm_sched_fault is executed after gfx_v9_0_cp_gfx_start is completed which sets the ready
field of the scheduler to true even  for uninitialized schedulers and causes oops vs
no fault or when ISR  drm_sched_fault is completed prior  gfx_v9_0_cp_gfx_start and
NULL pointer dereference does not occur.

Use the field timeout_wq  to prevent oops for uninitialized schedulers.
The field could be initialized by the work queue of resetting the domain.

v1: Corrections to commit message (Luben)


Remediation:
cmd/go: Protocol Fallback when fetching modules
CVE: CVE-2023-45285
Component: golang
CWE: CWE-693
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-12-06T00:00:00+00:00

A flaw was found in the Golang package cmd/go. This issue permits the fallback to insecure "git://" if trying to fetch a .git module that has no "https://" or "git+ssh://" available.

Statement: Red Hat rates this issue as Moderate, as the default configuration avoids this behavior, mitigating the vulnerability.

Remediation:
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:0da6316466d60a3a4535d5fed3589feb0391989982fba59d47d4c729912d6363

      (For s390x architecture)
      The image digest is sha256:8dd9ec7f5d7d7990cf66182960dc6bbf4815295f5b252e3ae3e38b5f0f65ace1

      (For ppc64le architecture)
      The image digest is sha256:26674d2dad3e80fe0e34af948bba02f5ea93ae505180e3224177b913049103ba

      (For aarch64 architecture)
      The image digest is sha256:41d64cadd215782ebdfb54706481c5b70f8551522377849945d353771fdfe51a

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
This issue only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). In order to mitigate this, keep GOPROXY with default values and use a module proxy. This vulnerability is not explored with default GOPROXY value.
Heap buffer overflow in Skia
CVE: CVE-2023-4354
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-08-15T00:00:00+00:00

Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crypto: pcrypt - Fix hungtask for PADATA_RESET
CVE: CVE-2023-52813
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: pcrypt - Fix hungtask for PADATA_RESET

We found a hungtask bug in test_aead_vec_cfg as follows:

INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
 __switch_to+0x98/0xe0
 __schedule+0x6c4/0xf40
 schedule+0xd8/0x1b4
 schedule_timeout+0x474/0x560
 wait_for_common+0x368/0x4e0
 wait_for_completion+0x20/0x30
 wait_for_completion+0x20/0x30
 test_aead_vec_cfg+0xab4/0xd50
 test_aead+0x144/0x1f0
 alg_test_aead+0xd8/0x1e0
 alg_test+0x634/0x890
 cryptomgr_test+0x40/0x70
 kthread+0x1e0/0x220
 ret_from_fork+0x10/0x18
 Kernel panic - not syncing: hung_task: blocked tasks

For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.

The problem comes as following:
(padata_do_parallel)                 |
    rcu_read_lock_bh();              |
    err = -EINVAL;                   |   (padata_replace)
                                     |     pinst->flags |= PADATA_RESET;
    err = -EBUSY                     |
    if (pinst->flags & PADATA_RESET) |
        rcu_read_unlock_bh()         |
        return err

In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.

v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Kernel: Denial of Service in Netfilter's nf_tables component
CVE: CVE-2023-53701
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

No description is available for this CVE.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.