huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2025-6801
Component: Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability
Release date: 2025-06-27T22:58:47.807000+00:00

Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the saveNICParamsToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of SYSTEM. Was ZDI-CAN-24921.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Screen by Default Creates World Writable PTYs
CVE: CVE-2025-46803
Component: screen
CWE: CWE-282
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-05-13T16:41:25.959000+00:00

A flaw was found in Screen. The default mode for pseudo-terminals (PTYs) allocated by Screen was changed from 0620 to 0622. This vulnerability allows public writes to any PTYs in the system.

Statement: The change in the default PTY mode from 0620 to 0622 in Screen represents a significant security vulnerability because it directly exposes privileged terminal sessions to unauthorized local modification. In multi-user environments, PTYs act as communication endpoints between user shells and the system, and world-writable PTYs (0622) allow any user on the system to inject arbitrary input into another user’s terminal. Unlike a typical permission misconfiguration that may be considered a moderate flaw, this vulnerability can lead to active session hijacking, command injection, or data corruption in interactive processes like shells, editors, and administrative sessions. As PTYs are foundational to the UNIX security model for user isolation, this vulnerability undermines the integrity of user sessions and can result in privilege escalation when combined with poorly secured scripts or session contexts.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
nbdkit-server: off-by-one error when processing block status may lead to a Denial of Service
CVE: CVE-2025-47711
Component: nbdkit
CWE: CWE-193
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-23T00:00:00+00:00

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

Statement: This vulnerability was rated as a Moderate severity by the Red Hat Product Security team. Based on the fact that while this vulnerability can be exploited remotely (AV:N) with relative ease (AC:L), it does require the attacker to have valid credentials to the target (PR:L). The primary impact is a temporary denial-of-service (A:L), meaning the server becomes unavailable, potentially disrupting dependent services. However, this exploitation does not lead to any compromise of data confidentiality (C:N) or integrity (I:N).

Remediation:
ftrace: Add cond_resched() to ftrace_graph_set_hash()
CVE: CVE-2025-37940
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Add cond_resched() to ftrace_graph_set_hash()

When the kernel contains a large number of functions that can be traced,
the loop in ftrace_graph_set_hash() may take a lot of time to execute.
This may trigger the softlockup watchdog.

Add cond_resched() within the loop to allow the kernel to remain
responsive even when processing a large number of functions.

This matches the cond_resched() that is used in other locations of the
code that iterates over all functions that can be traced.

Statement: Iterating over a large set of traceable functions could trigger soft lockups, affecting system responsiveness. Not exploitable by unprivileged users (requires CAP_SYS_ADMIN). No impact on confidentiality or integrity. Only availability affected due to potential soft lockup in specific configurations.

Remediation:
File overwrite in saltstack
CVE: CVE-2025-22241
Component: salt
CVSS v3: 5.8/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-06-13T07:04:38.695000+00:00

A path traversal flaw was found in the salt project. Unvalidated input could be provided by a minion, which could overwrite or create files in the "pki directory".

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
CVE: CVE-2025-21894
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC

Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only
ENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash
if VFs are used to test one-step timestamp, the crash log as follows.

[  129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0
[  129.287769] Call trace:
[  129.290219]  enetc_port_mac_wr+0x30/0xec (P)
[  129.294504]  enetc_start_xmit+0xda4/0xe74
[  129.298525]  enetc_xmit+0x70/0xec
[  129.301848]  dev_hard_start_xmit+0x98/0x118


Remediation:
Tempo Operator Token Exposition lead to read sensitive data
CVE: CVE-2025-2842
Component: tempo-operator
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-27T00:00:00+00:00

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.
This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

Statement: Red Hat has evaluated this vulnerability and rated with a Moderate impact as the attacker is limited to read access and requires previous permissions to read the token and get access to the cluster metrics.

Remediation:
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
Currently, no mitigation is available for this vulnerability.
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
CVE: CVE-2025-21744
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()

On removal of the device or unloading of the kernel module a potential NULL
pointer dereference occurs.

The following sequence deletes the interface:

  brcmf_detach()
    brcmf_remove_interface()
      brcmf_del_if()

Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to
BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.

After brcmf_remove_interface() call the brcmf_proto_detach() function is
called providing the following sequence:

  brcmf_detach()
    brcmf_proto_detach()
      brcmf_proto_msgbuf_detach()
        brcmf_flowring_detach()
          brcmf_msgbuf_delete_flowring()
            brcmf_msgbuf_remove_flowring()
              brcmf_flowring_delete()
                brcmf_get_ifp()
                brcmf_txfinalize()

Since brcmf_get_ip() can and actually will return NULL in this case the
call to brcmf_txfinalize() will result in a NULL pointer dereference inside
brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.

This will only happen if a flowring still has an skb.

Although the NULL pointer dereference has only been seen when trying to
update the tx statistic, all other uses of the ifp pointer have been
guarded as well with an early return if ifp is NULL.


Remediation:
Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling
CVE: CVE-2025-40257
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-04T00:00:00+00:00

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition in the `mptcp_pm_del_add_timer()` function allows for a use-after-free vulnerability. This can be exploited by a local attacker to cause a denial of service (DoS), potentially leading to privilege escalation or arbitrary code execution.


Remediation:
Inappropriate implementation in Downloads
CVE: CVE-2025-13635
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-02T19:00:12.931000+00:00

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
perf/core: Exit early on perf_mmap() fail
CVE: CVE-2025-38565
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Exit early on perf_mmap() fail

When perf_mmap() fails to allocate a buffer, it still invokes the
event_mapped() callback of the related event. On X86 this might increase
the perf_rdpmc_allowed reference counter. But nothing undoes this as
perf_mmap_close() is never called in this case, which causes another
reference count leak.

Return early on failure to prevent that.


Remediation:
serial: Fix potential null-ptr-deref in mlb_usio_probe()
CVE: CVE-2025-38135
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: Fix potential null-ptr-deref in mlb_usio_probe()

devm_ioremap() can return NULL on error. Currently, mlb_usio_probe()
does not check for this case, which could result in a NULL pointer
dereference.

Add NULL check after devm_ioremap() to prevent this issue.


Remediation:
Markdown-it Cross-site scripting
CVE: CVE-2025-7969
Component: markdown-it
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-08-21T16:40:05.915000+00:00

A cross-site scripting vulnerability was found in the markdown-it npm library. This flaw is related to incomplete sanitization during the processing of code blocks.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Certificate length was not properly checked
CVE: CVE-2025-1014
Component: firefox
CWE: CWE-1284
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-02-04T13:58:54.940000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: URL Bar Spoofing via non-BMP Unicode characters
CVE: CVE-2025-3029
Component: firefox
CWE: CWE-346
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-04-01T12:28:59.386000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
CVE: CVE-2025-12474
Component: libjxl
CWE: CWE-125
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.

This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
serial: 8250: fix panic due to PSLVERR
CVE: CVE-2025-39724
Component: kernel
CWE: CWE-362
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: fix panic due to PSLVERR

When the PSLVERR_RESP_EN parameter is set to 1, the device generates
an error response if an attempt is made to read an empty RBR (Receive
Buffer Register) while the FIFO is enabled.

In serial8250_do_startup(), calling serial_port_out(port, UART_LCR,
UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes
dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter
function enables the FIFO via serial_out(p, UART_FCR, p->fcr).
Execution proceeds to the serial_port_in(port, UART_RX).
This satisfies the PSLVERR trigger condition.

When another CPU (e.g., using printk()) is accessing the UART (UART
is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==
(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter
dw8250_force_idle().

Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock
to fix this issue.

Panic backtrace:
[    0.442336] Oops - unknown exception [#1]
[    0.442343] epc : dw8250_serial_in32+0x1e/0x4a
[    0.442351]  ra : serial8250_do_startup+0x2c8/0x88e
...
[    0.442416] console_on_rootfs+0x26/0x70

Statement: A race condition in the 8250 DW UART driver could trigger a PSLVERR and kernel panic when concurrent access occurs during device startup. The bug is only reachable with privileged access (e.g., console or driver initialization) and does not expose memory or data integrity risks. Impact is limited to a local denial of service.

Remediation:
Libtpms Out-of-Bounds Read Vulnerability
CVE: CVE-2025-49133
Component: libtpms
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.8/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
Release date: 2025-06-10T19:46:27.397000+00:00

A flaw was found in libtpms. A heap buffer overflow can occur in the `tpms_parse_pssh` function when parsing a malformed Public Signature Key Exchange (PSK) structure. A local attacker can trigger this overflow by providing a crafted PSK structure to the library. This can lead to a denial of service or allow for arbitrary code execution.

Statement: This vulnerability, identified as a potential out-of-bounds read, is triggered by inconsistent parameters within the CryptHmacSign function of the vTPM (virtual Trusted Platform Module). Although the attack is local to the system, it requires user interaction in the form of sending malicious commands to the vTPM. The primary impact is a denial-of-service (DoS) to the virtual machine (VM) by rendering its vTPM unavailable. This prevents the VM from utilizing critical TPM functionality, which can lead to significant operational disruption. While this flaw does not enable arbitrary code execution, the potential for DoS and broader system instability justifies a Moderate severity rating. The requirement for specific user interaction reduces its severity from what would otherwise be an Important classification.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GNU Binutils ld xmemdup.c xmemdup memory leak
CVE: CVE-2025-1151
Component: binutils
CWE: CWE-772
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-02-10T17:00:10.236000+00:00

A flaw was found in the ld linker utility of GNU Binutils. A specially-crafted payload may be able to trigger a memory leak, which can lead to an application crash or other undefined behavior.


Remediation:
CVE: CVE-2025-7986
Component: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-07-22T18:00:20.859000+00:00

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25755.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in carl9170 Wi-Fi driver via ping to failed device
CVE: CVE-2025-38420
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.9/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: do not ping device which has failed to load firmware

Syzkaller reports [1, 2] crashes caused by an attempts to ping
the device which has failed to load firmware. Since such a device
doesn't pass 'ieee80211_register_hw()', an internal workqueue
managed by 'ieee80211_queue_work()' is not yet created and an
attempt to queue work on it causes null-ptr-deref.

[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff
[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217


Remediation:
Linux kernel (JFS): Data corruption, information disclosure, and system unavailability via invalid inode mode.
CVE: CVE-2025-40312
Component: kernel
CWE: CWE-1287
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: Verify inode mode when loading from disk

The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.


Remediation:
To mitigate this issue on Red Hat Enterprise Linux 6 ELS, prevent the JFS filesystem module from loading if it is not required. This can be achieved by blacklisting the `jfs` module.

To blacklist the `jfs` module:
1. Create a file named `/etc/modprobe.d/blacklist-jfs.conf` with the following content:
   `blacklist jfs`
2. Regenerate the initramfs:
   `dracut -f -v` (for systems using dracut)
   `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (for systems using mkinitrd)
3. Reboot the system for the changes to take effect.

Note: Blacklisting the `jfs` module will prevent the system from mounting JFS filesystems. Ensure that no critical system operations rely on JFS before applying this mitigation.
Envoy: mTLS certificate validation bypass via embedded null byte in SAN
CVE: CVE-2025-66220
Component: envoy
CWE: CWE-170
Severity: Moderate
CVSS v3: 5.5/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
Release date: 2025-12-03T18:31:50.389000+00:00

A flaw was found in Envoy. This vulnerability allows mTLS (mutual Transport Layer Security) certificate validation bypass via a certificate containing an embedded null byte (\0) inside an OTHERNAME SAN (Subject Alternative Name) value.

Statement: This vulnerability is rated Moderate for Red Hat products. Envoy's mTLS certificate matcher, when configured with `match_typed_subject_alt_names`, may incorrectly validate certificates containing an embedded null byte in the OTHERNAME SAN field. This could allow an attacker to bypass mTLS authentication if they can present a specially crafted certificate.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
ASoC: sma1307: Add NULL check in sma1307_setting_loaded()
CVE: CVE-2025-38070
Component: kernel
Severity: None
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: sma1307: Add NULL check in sma1307_setting_loaded()

All varibale allocated by kzalloc and devm_kzalloc could be NULL.
Multiple pointer checks and their cleanup are added.

This issue is found by our static analysis tool


Remediation: