huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Processing web content may lead to arbitrary code execution
CVE: CVE-2024-27808
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-09-25T00:00:00+00:00

A vulnerability was found in WebKit. This flaw allows a remote attacker to perform arbitrary code execution when processing web content. This flaw is caused by insufficient memory handling, which attackers could exploit to execute malicious code on affected systems.

Statement: This WebKit vulnerability marked as important because it enables remote attackers to execute malicious code on users' systems just by visiting compromised websites, posing significant risks like data theft and system compromise.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
CVE: CVE-2024-30334
Component: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-03-28T12:37:42.193000+00:00

Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22640.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nf_tables: pointer math issue in nft_byteorder_eval()
CVE: CVE-2024-0607
Component: kernel
CWE: CWE-229
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2024-01-16T00:00:00+00:00

A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.

Statement: Exploiting this flaw will require the CAP_NET_ADMIN access privilege in any user or network namespace.

Remediation:
To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the kernel netfilter module. 

For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278
gtp: pull network headers in gtp_dev_xmit()
CVE: CVE-2024-44999
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-09-04T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's GPRS Tunneling Protocol ( GTP ) driver, specifically in the gtp_dev_xmit() function. This issue is due to the IPv4 or IPv6 headers not being properly pulled into the skb->head before being accessed. This led to the use of uninitialized values, as reported by Kernel Memory Sanitizer (KMSAN).

Statement: This issue is classified as Moderate severity rather than Important due to the specific nature of the uninitialized value problem. The vulnerability involves the potential use of uninitialized memory in network header fields, which, while potentially exposing sensitive data or causing erratic behavior, generally requires a specific set of conditions to be exploited. The `pskb_inet_may_pull()` function addresses this by ensuring that necessary headers are correctly initialized before use.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
From NVD collector
CVE: CVE-2024-8372
Component: angularjs
CWE: CWE-1289
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2024-09-09T15:15:12.560000+00:00

A flaw was found in AngularJS. Improper sanitization of the srcset attribute may allow attackers to bypass common image source restrictions, allowing Content Spoofing.


Remediation:
af_unix: Clear stale u-&gt;oob_skb.
CVE: CVE-2024-35970
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the Linux kernel's Unix domain socket (af_unix) implementation, where stale Out-of-Band (OOB) data is not cleared from the receive queue. This issue arises when OOB data is dequeued but the associated `oob_skb` is not cleared, leading to incorrect behavior in subsequent `recv()` calls. It can cause deadlocks, improper data handling, and incorrect socket polling.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
multiple vulnerabilities
CVE: CVE-2024-31460
Component: cacti
Release date: 2024-05-14T00:00:00+00:00

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()`  function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()
CVE: CVE-2024-50173
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()

The group variable can't be used to retrieve ptdev in our second loop,
because it points to the previously iterated list_head, not a valid
group. Get the ptdev object from the scheduler instead.


Remediation:
riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
CVE: CVE-2024-42267
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()

Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly
kill the process and we don't BUG() the kernel.


Remediation:
gso: fix udp gso fraglist segmentation after pull from frag_list
CVE: CVE-2024-49978
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gso: fix udp gso fraglist segmentation after pull from frag_list

Detect gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.

Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.

In extreme cases they pull all data into skb linear. For UDP, this
causes a NULL ptr deref in __udpv4_gso_segment_list_csum at
udp_hdr(seg->next)->dest.

Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.


Remediation:
drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
CVE: CVE-2024-38568
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group

The perf tool allows users to create event groups through following
cmd [1], but the driver does not check whether the array index is out
of bounds when writing data to the event_group array. If the number of
events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the
memory write overflow of event_group array occurs.

Add array index check to fix the possible array out of bounds violation,
and return directly when write new events are written to array bounds.

There are 9 different events in an event_group.
[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}


Remediation:
.NET Denial of Service Vulnerability
CVE: CVE-2024-21319
Component: dotnet
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2024-01-10T00:00:00+00:00

A Denial of Service vulnerability was found in .NET Core project templates that utilize JWT-based authentication tokens. This issue may allow an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests.

Statement: This DoS vulnerability in .NET Core project templates utilizing JWT-based authentication tokens is considered a moderate issue due to its restricted impact. While unauthenticated clients can exploit the server's memory, potentially causing an out-of-memory condition and service disruption, the vulnerability does not lead to remote code execution or compromise sensitive data. Its exploitability is contingent on specific project configurations, limiting the scope of affected systems.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
CVE: CVE-2024-23324
Component: envoy
CWE: CWE-20
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-02-09T17:00:00+00:00

A flaw was found in the Envoy proxy. External authentication can be bypassed by downstream connections that use the PROXY protocol. Downstream clients can force invalid gRPC requests to send to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true.


Remediation:
buffer overflow in read_iptc_profile() function when reading images in TIFF format
CVE: CVE-2024-28568
Component: freeimage
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-03-20T00:00:00+00:00

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the read_iptc_profile() function when reading images in TIFF format.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
stack-overflow in pdftotext
CVE: CVE-2024-3247
Component: xpdf
CWE: CWE-674
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-04-02T00:00:00+00:00

A flaw was found in the 'pdftotext' component of Xpdf. This flaw allows a local attacker to trigger a stack overflow condition using specially crafted input, possibly leading to an application crash.


Remediation:
usb: dwc3: st: fix probed platform device ref count on probe error path
CVE: CVE-2024-46674
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: st: fix probed platform device ref count on probe error path

The probe function never performs any paltform device allocation, thus
error path "undo_platform_dev_alloc" is entirely bogus.  It drops the
reference count from the platform device being probed.  If error path is
triggered, this will lead to unbalanced device reference counts and
premature release of device resources, thus possible use-after-free when
releasing remaining devm-managed resources.


Remediation:
world-readable /etc/shadow file
CVE: CVE-2024-2905
Component: rpm-ostree
CWE: CWE-732
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-04-09T11:00:00+00:00

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Statement: This vulnerability lets local, unconfined applications read the hashed password for all users of the system from those files. To gain further access to the system, those hashed passwords need to be brute-forced to discover the real passwords that may be used to authenticate as a more privileged user on the system, for example over SSH.

On systems with SELinux enabled and in enforcing mode, access to those files is limited to unconfined (usually interactive) users, unconfined systemd services and privileged containers. Confined daemons, users and containers are not able to access them.


Only OpenShift clusters installed on OCP version 4.14 and later are affected.
OpenShift Clusters installed on previous OCP releases or updated to 4.14 and later are not affected, because /etc/shadow is usually “locally modified” and the local version remains.
Clusters with no passwords set for any users (i.e. only SSH keys were used; the OpenShift default) are not impacted by this vulnerability even though it is present on the node.

Remediation:
If you need to apply the fix immediately, you can run the following commands, using credentials that have administrator access to an OpenShift cluster:

# List current permissions for all nodes
for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- bash -c "ls -alhZ /host/etc/*shadow*"; done

# Set correct permissions
for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- chmod --verbose 0000 /host/etc/shadow /host/etc/gshadow /host/etc/shadow- /host/etc/gshadow-; done

As a precaution, we recommend rotating all user credentials stored in those files.
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
CVE: CVE-2024-26825
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: free rx_data_reassembly skb on NCI device cleanup

rx_data_reassembly skb is stored during NCI data exchange for processing
fragmented packets. It is dropped only when the last fragment is processed
or when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received.
However, the NCI device may be deallocated before that which leads to skb
leak.

As by design the rx_data_reassembly skb is bound to the NCI device and
nothing prevents the device to be freed before the skb is processed in
some way and cleaned, free it on the NCI device cleanup.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.


Remediation:
drm/amd/pm: fix the Out-of-bounds read warning
CVE: CVE-2024-46731
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix the Out-of-bounds read warning

using index i - 1U may beyond element index
for mc_data[] when i = 0.


Remediation:
Bypass network import restriction via data URL
CVE: CVE-2024-22020
Component: nodejs
Severity: Moderate
CVSS v3: 6.5/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
Release date: 2024-07-09T00:00:00+00:00

A flaw was found in the Node.js package. By embedding non-network imports in data URLs, this flaw allows an attacker to execute arbitrary code, compromising system security.

Statement: This vulnerability is categorized as moderate severity rather than high due to its specific conditions for exploitation and impact scope. While the flaw permits bypassing network import restrictions via data URLs to execute arbitrary code, its exploitation is contingent on the attacker’s ability to inject and execute code within a controlled environment. The impact is constrained to scenarios where the vulnerable application processes data URLs and lacks robust validation mechanisms. Additionally, this issue requires the attacker to exploit specific code paths and permissions, which limits its widespread applicability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Type Confusion in V8
CVE: CVE-2024-6100
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-06-18T00:00:00+00:00

Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mm: swap: fix race between free_swap_and_cache() and swapoff()
CVE: CVE-2024-26960
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: swap: fix race between free_swap_and_cache() and swapoff()

The Linux kernel CVE team has assigned CVE-2024-26960 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26960-ad6b@gregkh/T


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
.NET Core - DoS - (unbounded work factor) in NrbfDecoder component
CVE: CVE-2024-43499
Component: dotnet
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-12T00:00:00+00:00

A vulnerability was found in .NET. Specifically .NET 9.0 Core - DoS - (unbounded work factor) in NrbfDecoder component

Statement: Red Hat has the information for this vulnerability and its limitation to only .NET Core 9.0. No other versions are expected to be vulnerable to this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SUNRPC: fix some memleaks in gssx_dec_option_array
CVE: CVE-2024-27388
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

A flaw was found in the auth_rpcgss module in the Linux kernel. A memory leak can occur due to improper error handling, potentially impacting system performance and possibly resulting in a denial of service.

Statement: This vulnerability does not affect the auth_rpcgss module in the Linux kernel as shipped in Red Hat Enterprise Linux 9 because it already contains the fix for this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.