huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
CVE: CVE-2023-53842
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A resource leak was found in the WCD MBHC v2 audio codec driver in the Linux kernel. MBHC resources are not properly released on component probe failure or removal, causing interrupt request failures and preventing successful reprobing of the codec component. This leads to sound card initialization failures after probe deferrals.

Statement: This issue affects Qualcomm WCD audio codec hardware found in specific ARM-based platforms. Standard x86 server and desktop systems do not include this hardware and are unaffected.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c
CVE: CVE-2023-46343
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A NULL pointer dereference was found in send_acknowledge in net/nfc/nci/spi.c in the Linux kernel.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Permissions policies can be bypassed via Module._load
CVE: CVE-2023-32002
Component: nodejs
CWE: CWE-1268
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-08-09T00:00:00+00:00

A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

Statement: This vulnerability is rated Important instead of Critical because it only impacts users of the policy mechanism that must be explicitly enabled using the `--experimental-policy` flag. This is not enabled by default.

Red Hat's Secure Software Development Life Cycle utilizes a layered testing approach. This significantly increases attack complexity, because a compromised package must remain undetected for months to years in testing in upstream communities before it could be adopted into a Red Hat product. This long dwell-time reduces impact to Important.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to file descriptor leak in io_uring with ocfs2
CVE: CVE-2023-53511
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel. A local user can exploit a file descriptor leak in the `io_uring` subsystem when performing operations on filesystems that do not support nowait buffered read, such as `ocfs2`. This vulnerability occurs because a file descriptor (fget) is acquired but not properly released (fput), leading to a resource leak. The most important consequence is a Denial of Service (DoS), which can prevent the unmounting of affected filesystems.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c
CVE: CVE-2023-0804
Component: libtiff
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the extractContigSamplesShifted24bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
Use after free in Passwords
CVE: CVE-2023-5186
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-09-27T00:00:00+00:00

Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ksmbd: fix uaf in smb20_oplock_break_ack
CVE: CVE-2023-52479
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-reference vulnerability was found in the Linux kernel, where accessing the opinfo structure after its reference count has been decremented using the opinfo_put() function could allow access to invalid or freed memory.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Remediation:
CVE: CVE-2023-44407
Component: D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-10-04T23:05:01.921000+00:00

D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18826.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in Picture in Picture
CVE: CVE-2023-7011
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-10-31T00:00:00+00:00

An inappropriate implementation flaw was found in Picture in Picture in Google Chrome. This issue may allow a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ASoC: fsl_mqs: move of_node_put() to the correct location
CVE: CVE-2023-53268
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl_mqs: move of_node_put() to the correct location

of_node_put() should have been done directly after
mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
otherwise it creates a reference leak on the success path.

To fix this, of_node_put() is moved to the correct location, and change
all the gotos to direct returns.

Statement: This LOW impact vulnerability in the Linux kernel's fsl_mqs ASoC driver involves a reference leak. As such, it has a low impact on availability, since it does not immediately lead to DoS or kpanics, but can lead to resource exhaustion in a long-term use scenario.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
CVE: CVE-2023-52880
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc

Any unprivileged user can attach N_GSM0710 ldisc, but it requires
CAP_NET_ADMIN to create a GSM network anyway.

Require initial namespace CAP_NET_ADMIN to do that.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
CVE: CVE-2023-54057
Component: kernel
CWE: CWE-120
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A stack buffer overflow vulnerability was found in the Linux kernel's AMD IOMMU driver. The parse_ivrs_acpihid() function uses sscanf() to parse the ivrs_acpihid kernel command-line parameter without specifying a field width limit. An overly long ACPI HID string can overflow the fixed-size acpiid buffer on the stack.

Statement: This flaw requires the ability to set kernel boot parameters, which typically requires root or physical access. The ivrs_acpihid parameter is used to manually specify ACPI device mappings for AMD IOMMU. Since kernel command-line parameters are controlled at boot time by privileged users, the attack surface is limited to scenarios where an attacker already has elevated access.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
nvme-core: fix memory leak in dhchap_ctrl_secret
CVE: CVE-2023-53792
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-core: fix memory leak in dhchap_ctrl_secret

Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we
return when nvme_auth_generate_key() returns error.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
delete permissions are not saved when creating public share
CVE: CVE-2023-25817
Component: nextcloud-server
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2023-03-27T00:00:00+00:00

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-51605
Component: Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
Release date: 2023-12-20T22:49:48.039000+00:00

Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
. Was ZDI-CAN-18644.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
octeon_ep: cancel queued works in probe error path
CVE: CVE-2023-53638
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

octeon_ep: cancel queued works in probe error path

If it fails to get the devices's MAC address, octep_probe exits while
leaving the delayed work intr_poll_task queued. When the work later
runs, it's a use after free.

Move the cancelation of intr_poll_task from octep_remove into
octep_device_cleanup. This does not change anything in the octep_remove
flow, but octep_device_cleanup is called also in the octep_probe error
path, where the cancelation is needed.

Note that the cancelation of ctrl_mbox_task has to follow
intr_poll_task's, because the ctrl_mbox_task may be queued by
intr_poll_task.

Statement: A UAF in the octeon_ep driver’s probe error path left a delayed work item (intr_poll_task) queued after device teardown, leading to use-after-free when the work later runs. Exploitation requires controlling device probe/driver lifecycle (module/hardware management), so for the CVSS the PR:H applies and exposure is limited to privileged users or physical attackers.

Remediation:
kcm: Fix memory leak in error path of kcm_sendmsg()
CVE: CVE-2023-54112
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

kcm: Fix memory leak in error path of kcm_sendmsg()

syzbot reported a memory leak like below:

BUG: memory leak
unreferenced object 0xffff88810b088c00 (size 240):
  comm "syz-executor186", pid 5012, jiffies 4294943306 (age 13.680s)
  hex dump (first 32 bytes):
    00 89 08 0b 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83e5d5ff>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:634
    [<ffffffff84606e59>] alloc_skb include/linux/skbuff.h:1289 [inline]
    [<ffffffff84606e59>] kcm_sendmsg+0x269/0x1050 net/kcm/kcmsock.c:815
    [<ffffffff83e479c6>] sock_sendmsg_nosec net/socket.c:725 [inline]
    [<ffffffff83e479c6>] sock_sendmsg+0x56/0xb0 net/socket.c:748
    [<ffffffff83e47f55>] ____sys_sendmsg+0x365/0x470 net/socket.c:2494
    [<ffffffff83e4c389>] ___sys_sendmsg+0xc9/0x130 net/socket.c:2548
    [<ffffffff83e4c536>] __sys_sendmsg+0xa6/0x120 net/socket.c:2577
    [<ffffffff84ad7bb8>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84ad7bb8>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

In kcm_sendmsg(), kcm_tx_msg(head)->last_skb is used as a cursor to append
newly allocated skbs to 'head'. If some bytes are copied, an error occurred,
and jumped to out_error label, 'last_skb' is left unmodified. A later
kcm_sendmsg() will use an obsoleted 'last_skb' reference, corrupting the
'head' frag_list and causing the leak.

This patch fixes this issue by properly updating the last allocated skb in
'last_skb'.


Remediation:
CVE: CVE-2023-40501
Component: LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability
Release date: 2023-08-24T21:13:36.761000+00:00

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the copyContent command. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19945.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: cdns3: Put the cdns set active part outside the spin lock
CVE: CVE-2023-53287
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Put the cdns set active part outside the spin lock

The device may be scheduled during the resume process,
so this cannot appear in atomic operations. Since
pm_runtime_set_active will resume suppliers, put set
active outside the spin lock, which is only used to
protect the struct cdns data structure, otherwise the
kernel will report the following warning:

  BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163
  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh
  preempt_count: 1, expected: 0
  RCU nest depth: 0, expected: 0
  CPU: 0 PID: 651 Comm: sh Tainted: G        WC         6.1.20 #1
  Hardware name: Freescale i.MX8QM MEK (DT)
  Call trace:
    dump_backtrace.part.0+0xe0/0xf0
    show_stack+0x18/0x30
    dump_stack_lvl+0x64/0x80
    dump_stack+0x1c/0x38
    __might_resched+0x1fc/0x240
    __might_sleep+0x68/0xc0
    __pm_runtime_resume+0x9c/0xe0
    rpm_get_suppliers+0x68/0x1b0
    __pm_runtime_set_status+0x298/0x560
    cdns_resume+0xb0/0x1c0
    cdns3_controller_resume.isra.0+0x1e0/0x250
    cdns3_plat_resume+0x28/0x40


Remediation:
InnoDB unspecified vulnerability (CPU Apr 2023)
CVE: CVE-2023-21911
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-04-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Authenticated remote code execution risk in Lesson
CVE: CVE-2023-5539
Component: moodle
CVSS v3: 5.7/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-10-16T04:00:00+00:00

A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: