huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2025-13713
Component: Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2025-12-01T22:44:03.257000+00:00

Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent Hunyuan3D-1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the load_pretrained function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27191.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Suricata: Keyword tls.subjectaltname can lead to NULL-ptr deref
CVE: CVE-2025-59150
Component: suricata
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-01T20:23:54.207000+00:00

A vulnerability was found in Suricata where a usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
rpc.mountd in the nfs-utils privilege escalation
CVE: CVE-2025-12801
Component: nfs-utils
CWE: CWE-279
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the
privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

Statement: This MODERATE impact vulnerability in `rpc.mountd` within the `nfs-utils` package allows an authenticated NFSv3 client to bypass configured `root_squash` or `all_squash` restrictions. This enables the client to access subdirectories of an exported NFS share with elevated privileges, regardless of the intended file permissions. Red Hat Enterprise Linux systems configured as NFSv3 servers are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/mlx5: Fix variable not being completed when function returns
CVE: CVE-2025-21662
Component: kernel
Severity: None
Release date: 2025-01-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix variable not being completed when function returns

When cmd_alloc_index(), fails cmd_work_handler() needs
to complete ent->slotted before returning early.
Otherwise the task which issued the command may hang:

   mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry
   INFO: task kworker/13:2:4055883 blocked for more than 120 seconds.
         Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1
   "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
   kworker/13:2    D    0 4055883      2 0x00000228
   Workqueue: events mlx5e_tx_dim_work [mlx5_core]
   Call trace:
      __switch_to+0xe8/0x150
      __schedule+0x2a8/0x9b8
      schedule+0x2c/0x88
      schedule_timeout+0x204/0x478
      wait_for_common+0x154/0x250
      wait_for_completion+0x28/0x38
      cmd_exec+0x7a0/0xa00 [mlx5_core]
      mlx5_cmd_exec+0x54/0x80 [mlx5_core]
      mlx5_core_modify_cq+0x6c/0x80 [mlx5_core]
      mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core]
      mlx5e_tx_dim_work+0x54/0x68 [mlx5_core]
      process_one_work+0x1b0/0x448
      worker_thread+0x54/0x468
      kthread+0x134/0x138
      ret_from_fork+0x10/0x18


Remediation:
udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution
CVE: CVE-2025-0689
Component: grub2
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-02-18T18:00:00+00:00

When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based buffer overflow resulting in critical data to be corrupted, resulting in the risk of arbitrary code execution by-passing secure boot protections.

Statement: To exploit this flaw, an attacker needs to trick a user into running grub2 with a specially crafted UDF file system image, limiting the exposure of this flaw. For this reason, this vulnerability has been rated with a Moderate severity.

The grub2 package as shipped in Red Hat Enterprise Linux 7, 8, 9 and in Red Hat OpenShift Container Platform 4 is not affected by this vulnerability because the UDF module is not built, so this issue is not applicable.

Remediation:
Do not run grub2 in an untrusted environment, specifically with a UDF file system image.
Envoy Admin Interface Exposed through prometheus metrics endpoint
CVE: CVE-2025-24030
Component: github.com/envoyproxy/gateway
CWE: CWE-419
Severity: Important
CVSS v3: 7.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-01-23T03:20:27.802000+00:00

A flaw was found in Envoy Gateway. This vulnerability allows a user with access to a Kubernetes cluster where Envoy Gateway is installed to use a path traversal attack to execute Envoy Admin interface commands on proxies managed by Envoy Gateway. The admin interface can terminate the Envoy process and extract the Envoy configuration, possibly containing confidential data.

Statement: This vulnerability marked as Important rather than Moderate due to its potential to compromise the core functionality and security of the Envoy Gateway. The path traversal exploit enables attackers within the Kubernetes cluster to access the Envoy Admin interface, which is highly privileged and designed for debugging and operational control. By exploiting this flaw, attackers can terminate critical processes or retrieve sensitive configuration data, such as API keys, secrets, or routing rules, directly impacting the confidentiality, integrity, and availability of the system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
CVE: CVE-2025-38013
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request

Make sure that n_channels is set after allocating the
struct cfg80211_registered_device::int_scan_req member. Seen with
syzkaller:

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

This was missed in the initial conversions because I failed to locate
the allocation likely due to the "sizeof(void *)" not matching the
"channels" array type.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Open Babel smilesformat.cpp ParseSmiles heap-based overflow
CVE: CVE-2025-10996
Component: openbabel
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-09-26T02:32:06.533000+00:00

A vulnerability was detected in Open Babel. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Asyncmy SQL injection
CVE: CVE-2025-65896
Component: asyncmy
CVSS v3: 8.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-12-02T00:00:00+00:00

SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ingress-nginx controller - configuration injection via unsanitized mirror annotations
CVE: CVE-2025-1098
Component: ingress-nginx
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-03-24T23:29:15.610000+00:00

A flaw was found in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This issue can lead to arbitrary code execution in the context of the ingress-nginx controller and disclosure of Secrets accessible to the controller. Note that the controller can access all Secrets cluster-wide in the default installation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Next.js Content Injection Vulnerability for Image Optimization
CVE: CVE-2025-55173
Component: nextjs
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-08-29T22:00:05.765000+00:00

A vulnerability in Next.js Image Optimization allowed attacker-controlled image servers to trigger arbitrary file downloads with custom content and filenames. Exploitation required permissive images.domains or images.remotePatterns and user interaction.

Binary-Affected: Next.js
Upstream-version-introduced: v14.2.30 
Upstream-version-fixed: v15.4.5 and v14.2.31

Statement: This issue is classified as Moderate rather than Important because exploitation requires a very specific set of conditions: the target Next.js app must be configured with permissive external image domains or patterns, the attacker must control or influence the remote image server, and a user must be tricked into clicking a crafted link. The vulnerability does not provide direct code execution, privilege escalation, or server compromise—it primarily enables arbitrary file downloads, which increases the risk of phishing and social engineering rather than direct technical exploitation. Since the attack vector relies on user interaction and misconfiguration rather than a default behavior, the overall impact is contained, making it less severe than flaws that directly compromise application integrity or confidentiality.

Remediation:
Mitigation includes restricting images.domains and images.remotePatterns to trusted hosts only, avoiding permissive configurations, and monitoring logs for suspicious image fetches.
python: Extraction filter bypass for linking outside extraction directory
CVE: CVE-2025-4330
Component: cpython
CWE: CWE-22
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-06-03T12:58:57.452000+00:00

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of this access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: gso: fix ownership in __udp_gso_segment
CVE: CVE-2025-21926
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: gso: fix ownership in __udp_gso_segment

In __udp_gso_segment the skb destructor is removed before segmenting the
skb but the socket reference is kept as-is. This is an issue if the
original skb is later orphaned as we can hit the following bug:

  kernel BUG at ./include/linux/skbuff.h:3312!  (skb_orphan)
  RIP: 0010:ip_rcv_core+0x8b2/0xca0
  Call Trace:
   ip_rcv+0xab/0x6e0
   __netif_receive_skb_one_core+0x168/0x1b0
   process_backlog+0x384/0x1100
   __napi_poll.constprop.0+0xa1/0x370
   net_rx_action+0x925/0xe50

The above can happen following a sequence of events when using
OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an
OVS_ACTION_ATTR_OUTPUT action:

1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb
   goes through queue_gso_packets and then __udp_gso_segment, where its
   destructor is removed.
2. The segments' data are copied and sent to userspace.
3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the
   same original skb is sent to its path.
4. If it later hits skb_orphan, we hit the bug.

Fix this by also removing the reference to the socket in
__udp_gso_segment.

Statement: If UDP fragmentation offload being used (that allows a device to fragment an oversized UDP datagram into multiple IPv fragments), then this bug could happen. The bug happens when skb_orphan function later being called. It is complex to trigger the bug (few conditions should happen simultaneously) and only local user can trigger it.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
4in6 and 6in6 protocols excessive trust
CVE: CVE-2025-23018
Component: networkmanager
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Release date: 2025-01-14T12:00:00+00:00

An insecure configuration flaw was found in the IPv4-in-IPv6 and IPv6-in-IPv6 protocols (RFC2473). When configured to not require authentication or filtering, this issue could allow a remote unauthenticated attacker to spoof packets or bypass access controls.

Statement: This vulnerability is rated as Low impact as it requires a known higher risk configuration. Multiple layers of defaults (packet forwarding and these specific protocols) are disabled by default. Red Hat provides guidance in documentation (linked in references section) on how to configure the system in a more secure manner, which avoids the risk of this vulnerability.

Remediation:
See references section for detailed guidance.
jfs: fix array-index-out-of-bounds read in add_missing_indices
CVE: CVE-2025-38204
Component: kernel
Severity: None
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds read in add_missing_indices

stbl is s8 but it must contain offsets into slot which can go from 0 to
127.

Added a bound check for that error and return -EIO if the check fails.
Also make jfs_readdir return with error if add_missing_indices returns
with an error.


Remediation:
drm/xe/guc: Check GuC running state before deregistering exec queue
CVE: CVE-2025-40166
Component: kernel
CWE: CWE-664
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Check GuC running state before deregistering exec queue

In normal operation, a registered exec queue is disabled and
deregistered through the GuC, and freed only after the GuC confirms
completion. However, if the driver is forced to unbind while the exec
queue is still running, the user may call exec_destroy() after the GuC
has already been stopped and CT communication disabled.

In this case, the driver cannot receive a response from the GuC,
preventing proper cleanup of exec queue resources. Fix this by directly
releasing the resources when GuC is not running.

Here is the failure dmesg log:
"
[  468.089581] ---[ end trace 0000000000000000 ]---
[  468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535)
[  468.090558] pci 0000:03:00.0: [drm] GT0:     total 65535
[  468.090562] pci 0000:03:00.0: [drm] GT0:     used 1
[  468.090564] pci 0000:03:00.0: [drm] GT0:     range 1..1 (1)
[  468.092716] ------------[ cut here ]------------
[  468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]
"

v2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled().
    As CT may go down and come back during VF migration.

(cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea)


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
pinctrl: canaan: k230: Fix order of DT parse and pinctrl register
CVE: CVE-2025-38654
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: canaan: k230: Fix order of DT parse and pinctrl register

Move DT parse before pinctrl register. This ensures that device tree
parsing is done before calling devm_pinctrl_register() to prevent using
uninitialized pin resources.


Remediation:
tls: make sure to abort the stream if headers are bogus
CVE: CVE-2025-39946
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: make sure to abort the stream if headers are bogus

Normally we wait for the socket to buffer up the whole record
before we service it. If the socket has a tiny buffer, however,
we read out the data sooner, to prevent connection stalls.
Make sure that we abort the connection when we find out late
that the record is actually invalid. Retrying the parsing is
fine in itself but since we copy some more data each time
before we parse we can overflow the allocated skb space.

Constructing a scenario in which we're under pressure without
enough data in the socket to parse the length upfront is quite
hard. syzbot figured out a way to do this by serving us the header
in small OOB sends, and then filling in the recvbuf with a large
normal send.

Make sure that tls_rx_msg_size() aborts strp, if we reach
an invalid record there's really no way to recover.

Statement: Malformed TLS records could be fed to kTLS so that parsing happened only after incremental copy, risking an out-of-bounds write in the skb.
Exploitation requires kTLS to be enabled on the target system.
For the Red Hat Enterprise Linux the kTLS available, but disabled by default.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.