huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
x86/kexec: Fix bug with call depth tracking
CVE: CVE-2024-40944
Component: kernel
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's x86/kexec component, where the function call to cc_platform_has() could lead to a system crash when call depth tracking is active. This issue occurs because the GS segment is reset by load_segments(), setting GS_BASE to 0, while call depth tracking relies on per-CPU variables.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2024-30345
Component: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-03-28T12:39:02.686000+00:00

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22742.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Elasticsearch Uncontrolled Resource Consumption vulnerability
CVE: CVE-2024-52979
Component: elasticsearch
CWE: CWE-400
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in Elasticsearch. This flaw allows a remote attacker to trigger an application-level denial of service by sending specially crafted search templates that use Mustache functions.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
multiple CVEs
CVE: CVE-2024-29164
Component: hdf5
Severity: Moderate
Release date: 2024-05-10T00:00:00+00:00

HDF5 through 1.14.3 contains a stack buffer overflow in H5R__decode_heap, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
pkcs15init: Usage of uninitialized values in libopensc and pkcs15init
CVE: CVE-2024-45615
Component: libopensc
CWE: CWE-457
Severity: Low
CVSS v3: 3.9/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-09-02T00:00:00+00:00

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. 
The problem is missing  initialization of variables expected to be initialized (as arguments to other functions, etc.).


Remediation:
Inappropriate implementation in UI in Google Chrome
CVE: CVE-2024-7019
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2024-09-23T22:15:03.230000+00:00

Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ext4: make sure the first directory block is not a hole
CVE: CVE-2024-42304
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

The syzbot constructs a directory that has no dirblock but is non-inline,
i.e. the first directory block is a hole. And no errors are reported when
creating files in this directory. Then, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()
CVE: CVE-2024-56717
Component: kernel
CWE: CWE-843
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()

Packets injected by the CPU should have a SRC_PORT field equal to the
CPU port module index in the Analyzer block (ocelot->num_phys_ports).

The blamed commit copied the ocelot_ifh_set_basic() call incorrectly
from ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling
with "x", it calls with BIT_ULL(x), but the field is not a port mask,
but rather a single port index.

[ side note: this is the technical debt of code duplication :( ]

The error used to be silent and doesn't appear to have other
user-visible manifestations, but with new changes in the packing
library, it now fails loudly as follows:

------------[ cut here ]------------
Cannot store 0x40 inside bits 46-43 - will truncate
sja1105 spi2.0: xmit timed out
WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198
sja1105 spi2.0: timed out polling for tstamp
CPU: 1 UID: 0 PID: 102 Comm: felix_xmit
Tainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605
Call trace:
 __pack+0x90/0x198 (P)
 __pack+0x90/0x198 (L)
 packing+0x78/0x98
 ocelot_ifh_set_basic+0x260/0x368
 ocelot_port_inject_frame+0xa8/0x250
 felix_port_deferred_xmit+0x14c/0x258
 kthread_worker_fn+0x134/0x350
 kthread+0x114/0x138

The code path pertains to the ocelot switchdev driver and to the felix
secondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.

The messenger (packing) is not really to blame, so fix the original
commit instead.


Remediation:
ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
CVE: CVE-2024-57805
Component: kernel
Severity: None
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP

The linkDMA should not be released on stop trigger since a stream re-start
might happen without closing of the stream. This leaves a short time for
other streams to 'steal' the linkDMA since it has been released.

This issue is not easy to reproduce under normal conditions as usually
after stop the stream is closed, or the same stream is restarted, but if
another stream got in between the stop and start, like this:
aplay -Dhw:0,3 -c2 -r48000 -fS32_LE /dev/zero -d 120
CTRL+z
aplay -Dhw:0,0 -c2 -r48000 -fS32_LE /dev/zero -d 120

then the link DMA channels will be mixed up, resulting firmware error or
crash.


Remediation:
lib: objagg: Fix general protection fault
CVE: CVE-2024-43846
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

linux kernel's lib objagg can incorrectly permit object nesting in an unallowed circumstance, based on lack of appropriate checks stemming from assumption violations. The incorrect object creation from this assumption can lead to general protection fault.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Improper input validation in XmlCli feature for UEFI firmware
CVE: CVE-2024-24582
Component: microcode_ctl
CWE: CWE-20
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

An improper input validation flaw was found in the XmlCli feature for UEFI firmware. Some Intel(R) processors may allow a privileged user to enable privilege escalation via local access.

Statement: Red Hat has given this vulnerability the impact rating of Important due to the potential of escalating privileges locally.

Remediation:
phonet: fix rtm_phonet_notify() skb allocation
CVE: CVE-2024-36946
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phonet: fix rtm_phonet_notify() skb allocation

fill_route() stores three components in the skb:

- struct rtmsg
- RTA_DST (u8)
- RTA_OIF (u32)

Therefore, rtm_phonet_notify() should use

NLMSG_ALIGN(sizeof(struct rtmsg)) +
nla_total_size(1) +
nla_total_size(4)


Remediation:
um: Fix potential integer overflow during physmem setup
CVE: CVE-2024-53145
Component: kernel
CWE: CWE-190
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

um: Fix potential integer overflow during physmem setup

This issue happens when the real map size is greater than LONG_MAX,
which can be easily triggered on UML/i386.


Remediation:
smb: client: fix TCP timers deadlock after rmmod
CVE: CVE-2024-54680
Component: kernel
CWE: CWE-667
Severity: None
Release date: 2024-01-01T00:00:00+00:00

[REJECTED CVE] A vulnerability was suspected in the Linux kernel's SMB client module related to TCP timers and potential deadlocks after module removal (rmmod cifs). The issue stemmed from incorrect manual manipulation of sk->sk_net_refcnt, which led to TCP timers not being properly cleared, causing lockdep warnings and deadlocks. However, this was an internal kernel misconfiguration affecting cleanup behavior rather than a security flaw exploitable by an attacker. Since no privilege escalation or data exposure was possible, this does not qualify as a security vulnerability.

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2025040219-REJECTED-53c7@gregkh/

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Authenticated user can kill any process when enabling pam_env's user_readenv option
CVE: CVE-2024-6126
Component: cockpit
CWE: CWE-400
Severity: Low
CVSS v3: 3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
Release date: 2024-07-03T00:00:00+00:00

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

Statement: This vulnerability requires enabling the pam_env.so's "user_readenv" option. It disabled by default in Fedora and RHEL, and marked as deprecated/unsafe. In Debian/OpenSUSE it has enabled by default.

Remediation:
Disable pam_env's `user_readenv` option in PAM config.
aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
CVE: CVE-2024-52304
Component: aiohttp
CWE: CWE-444
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2024-11-18T20:12:48.612000+00:00

A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for example, without the usual C extensions, or `AIOHTTP_NO_EXTENSIONS` is enabled, an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.


Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform Execution Environments
Red Hat Ansible Automation Platform Execution Environments
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
CVE: CVE-2024-9729
Component: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-10-11T22:10:23.785000+00:00

Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24144.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/mlx5e: SHAMPO, Fix incorrect page release
CVE: CVE-2024-46717
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-18T00:00:00+00:00

under certain conditions-- no created skb, header_size == 0, and header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 -- a new skb is formed with no SHAMPO header, but a SHAMPO header page from header_index is released further down in the same function, leading to SHAMPO pages being released multiple times, which is incorrect.


Remediation:
To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Quay allows successful authentication with trucated version of the password
CVE: CVE-2024-9683
Component: quay
CWE: CWE-305
Severity: Low
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2024-10-09T00:00:00+00:00

A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement.  While the risk is relatively low due to the typical length of the passwords used (73 characters), this vulnerability can still be exploited to reduce the complexity of brute-force or password-guessing attacks. The truncation of passwords weakens the overall authentication process, thereby reducing the effectiveness of password policies and potentially increasing the risk of unauthorized access in the future.


Remediation:
net/smc: do not leave a dangling sk pointer in __smc_create()
CVE: CVE-2024-50293
Component: kernel
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-11-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/smc: do not leave a dangling sk pointer in __smc_create()

Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when
it does not clear sock->sk on failure."), syzbot found an issue with AF_SMC:

smc_create must clear sock->sk on failure, family: 43, type: 1, protocol: 0
 WARNING: CPU: 0 PID: 5827 at net/socket.c:1565 __sock_create+0x96f/0xa30 net/socket.c:1563
Modules linked in:
CPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
 RIP: 0010:__sock_create+0x96f/0xa30 net/socket.c:1563
Code: 03 00 74 08 4c 89 e7 e8 4f 3b 85 f8 49 8b 34 24 48 c7 c7 40 89 0c 8d 8b 54 24 04 8b 4c 24 0c 44 8b 44 24 08 e8 32 78 db f7 90 <0f> 0b 90 90 e9 d3 fd ff ff 89 e9 80 e1 07 fe c1 38 c1 0f 8c ee f7
RSP: 0018:ffffc90003e4fda0 EFLAGS: 00010246
RAX: 099c6f938c7f4700 RBX: 1ffffffff1a595fd RCX: ffff888034823c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000ffffffe9 R08: ffffffff81567052 R09: 1ffff920007c9f50
R10: dffffc0000000000 R11: fffff520007c9f51 R12: ffffffff8d2cafe8
R13: 1ffffffff1a595fe R14: ffffffff9a789c40 R15: ffff8880764298c0
FS:  000055557b518380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa62ff43225 CR3: 0000000031628000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  sock_create net/socket.c:1616 [inline]
  __sys_socket_create net/socket.c:1653 [inline]
  __sys_socket+0x150/0x3c0 net/socket.c:1700
  __do_sys_socket net/socket.c:1714 [inline]
  __se_sys_socket net/socket.c:1712 [inline]

For reference, see commit 2d859aff775d ("Merge branch
'do-not-leave-dangling-sk-pointers-in-pf-create-functions'")


Remediation:
ssl fails to validate incorrect extened key usage
CVE: CVE-2024-53846
Component: erlang
CWE: CWE-295
Severity: Moderate
CVSS v3: 4.8/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Release date: 2024-12-05T17:02:59.370000+00:00

A regression flaw was introduced into Erlang OTP's SSL application. This issue results in a server or client verifying the peer when incorrect extended key usage is presented. For example, a server will verify if a client has server auth ext key usage and vice versa.

Statement: No Red Hat products are shipped with an affected version of OTP.

Remediation:
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
CVE: CVE-2024-26946
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-01T00:00:00+00:00

An unsafe read function was found in arch/x86/kernel/kprobes/core.c in the Linux kernel .

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2024-27341
Component: Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2024-03-01T21:42:32.220000+00:00

Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22927.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Potential memory corruption may occur when cloning certain objects
CVE: CVE-2024-9396
Component: firefox
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2024-10-01T15:13:20.007000+00:00

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: It is currently unknown if this issue is exploitable, but a condition may arise where the structured clone of certain objects could lead to memory corruption.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
net: veth: clear GRO when clearing XDP even when down
CVE: CVE-2024-26803
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: veth: clear GRO when clearing XDP even when down

The Linux kernel CVE team has assigned CVE-2024-26803 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040404-CVE-2024-26803-9985@gregkh/T


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
thunderbird: Origin of permission prompt could be spoofed by long URL
CVE: CVE-2024-10462
Component: firefox
CWE: CWE-280
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2024-10-29T12:19:12.782000+00:00

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
information disclosure vulnerability
CVE: CVE-2024-22513
Component: djangorestframework-simplejwt
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-03-16T00:00:00+00:00

A flaw was found in djangorestframework-simplejwt. Affected versions of this package are vulnerable to information disclosure. This flaw allows a user to access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.


Remediation: