huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
DoS Vulnerability in ntpd-rs
CVE: CVE-2025-58066
Component: ntpd-rs
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-29T20:54:13.174000+00:00

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
CVE: CVE-2025-37838
Component: kernel
Severity: None
Release date: 2025-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

In the ssi_protocol_probe() function, &ssi->work is bound with
ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
within the ssip_pn_ops structure is capable of starting the
work.

If we remove the module which will call ssi_protocol_remove()
to make a cleanup, it will free ssi through kfree(ssi),
while the work mentioned above will be used. The sequence
of operations that may lead to a UAF bug is as follows:

CPU0                                    CPU1

                        | ssip_xmit_work
ssi_protocol_remove     |
kfree(ssi);             |
                        | struct hsi_client *cl = ssi->cl;
                        | // use ssi

Fix it by ensuring that the work is canceled before proceeding
with the cleanup in ssi_protocol_remove().


Remediation:
Moodle Assignment Submission Search Leaks Anonymous Student Identities
CVE: CVE-2025-3628
Component: moodle
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-04-22T12:00:00+00:00

A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-0907
Component: PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-01-31T22:08:14.571000+00:00

PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Slow client communication leads to a possible DoS attack
CVE: CVE-2025-58436
Component: cups
CWE: CWE-412
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-01T00:00:00+00:00

A flaw was found in cups. A client that connects to cupsd but sends slow messages, e.g. only one  byte per second, delays cupsd as a whole, such that it becomes unusable 
by other clients.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
scsi: aic94xx: fix use-after-free in device removal path
CVE: CVE-2025-71075
Component: kernel
CWE: CWE-364
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's AIC-94xx SAS/SATA controller driver. The asd_pci_remove() function frees the asd_ha structure without first synchronizing pending tasklets. If a tasklet is scheduled but not yet executed when the structure is freed, the tasklet will access freed memory, causing a kernel crash or corruption.

Statement: This can be triggered during PCI hot-unplug or module unload of the aic94xx driver. Systems with Adaptec AIC-94xx SAS controllers are affected. The fix adds tasklet_kill() to ensure proper synchronization before cleanup.

Remediation:
Unbounded allocation in virtio-crypto
CVE: CVE-2025-14876
Component: qemu-kvm
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-14T00:00:00+00:00

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

Statement: Using the virtio-crypto device in RHEL is not supported and strongly discouraged. The virtio-crypto devices are also not supported in any other virtualization solution provided by Red Hat.

Remediation:
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
CVE: CVE-2025-68254
Component: kernel
Severity: Moderate
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing

The Extended Supported Rates (ESR) IE handling in OnBeacon accessed
*(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these
offsets lie within the received frame buffer. A malformed beacon with
an ESR IE positioned at the end of the buffer could cause an
out-of-bounds read, potentially triggering a kernel panic.

Add a boundary check to ensure that the ESR IE body and the subsequent
bytes are within the limits of the frame before attempting to access
them.

This prevents OOB reads caused by malformed beacon frames.


Remediation:
CVE: CVE-2025-15334
Component: Tanium addressed an information disclosure vulnerability in Threat Response.
Release date: 2025-08-19T00:00:00+00:00

Tanium addressed an information disclosure vulnerability in Threat Response.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
CVE: CVE-2025-22047
Component: kernel
CWE: CWE-253
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/microcode/AMD: Fix __apply_microcode_amd()'s return value

When verify_sha256_digest() fails, __apply_microcode_amd() should propagate
the failure by returning false (and not -1 which is promoted to true).


Remediation:
kubevirt: VM administration denial of service via guest agent
CVE: CVE-2025-14525
Component: kubevirt
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a denial of service for administrative operations.

Statement: This vulnerability is rated Moderate for Red Hat OpenShift Virtualization. A malicious VM user can exploit this flaw when the guest agent is active, by causing it to report an excessive number of network interfaces. This action can lead to an application level denial of service for administrative operations by blocking updates to the Virtual Machine Instance (VMI) configuration.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
smb: client: fix UAF in decryption with multichannel
CVE: CVE-2025-37750
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2025-05-01T00:00:00+00:00

A use-after-free (UAF) vulnerability was found in the Linux kernel's SMB client functionality. A local attacker with permissions to connect to arbitrary SMB servers with precise timing could exploit this flaw to alter system memory, leading to denials of service, alteration of sensitive memory locations, or privilege escalation.

Statement: This vulnerability exists in how the SMB client manages cryptography for multi-channel connections. When using multi-channel connections, there is a possibility that a race condition will occur in separate threads. In that case, it is possible for one thread to free memory related to cryptography before another thread accesses it. An attacker could leverage that vulnerability to modify kernel memory, which could result in an escalation of privileges as well as potentially impacting system stability and integrity.

The changes in multichannel SMB client cryptography management that led to this vulnerability are not present in Red Hat Enterprise Linux prior to 9.6.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
buffer overflow in the GNU C Library's assert()
CVE: CVE-2025-0395
Component: glibc
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.5/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-01-22T13:11:30.406000+00:00

A flaw was found in the GNU C Library (glibc). A buffer overflow condition via the `assert()` function may be triggered due to glibc not allocating enough space for the assertion failure message string and size information. In certain conditions, a local attacker can exploit this, potentially leading to an application crash or other undefined behavior.

Statement: The bug is with glib assert() function that is typically used to identify logic errors in programs. The specific vulnerability stems in not enough being allocated to fit an arbitrary length error statement that is passed to the assert() function. The lack of any check on the string length causes the buffer overflow.

Remediation:
Invalid characters cause assert
CVE: CVE-2025-11232
Component: kea
CWE: CWE-823
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-29T18:02:39.421000+00:00

A flaw was found in Kea. A remote attacker can send specific option content to the kea-dhcp4 server. When the server is configured with specific parameters, an assertion failure can be triggered and cause the kea-dhcp4 process to exit unexpectedly, resulting in a denial of service.

Statement: To exploit this issue, three configuration parameters must have the following settings:

- hostname-char-set: must have the default setting, which is "[^A-Za-z0-9.-]".
- hostname-char-replacement: must be empty, which is the default value.
- ddns-qualifying-suffix: must NOT be empty, which is not the default.

A remote and unauthenticated attacker can cause the kea-dhcp4 process to exit unexpectedly by sending specific option content, preventing all DHCP clients it servers from obtaining new leases or renewing existing ones until the service is restarted. Due to this reason, this flaw has been rated with an important severity.

Remediation:
Set the "hostname-char-replacement" parameter to any non-empty value (the default is empty). For example, setting it to "x" is an effective workaround, regardless of other settings.

~~~
...
"hostname-char-replacement": "x",
...
~~~
gpio: xilinx: Convert gpio_lock to raw spinlock
CVE: CVE-2025-21684
Component: kernel
CWE: CWE-667
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we
must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

[    5.349336] =============================
[    5.353349] [ BUG: Invalid wait context ]
[    5.357361] 6.13.0-rc5+ #69 Tainted: G        W
[    5.363031] -----------------------------
[    5.367045] kworker/u17:1/44 is trying to lock:
[    5.371587] ffffff88018b02c0 (&chip->gpio_lock){....}-{3:3}, at: xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8))
[    5.380079] other info that might help us debug this:
[    5.385138] context-{5:5}
[    5.387762] 5 locks held by kworker/u17:1/44:
[    5.392123] #0: ffffff8800014958 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3204)
[    5.402260] #1: ffffffc082fcbdd8 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3205)
[    5.411528] #2: ffffff880172c900 (&dev->mutex){....}-{4:4}, at: __device_attach (drivers/base/dd.c:1006)
[    5.419929] #3: ffffff88039c8268 (request_class#2){+.+.}-{4:4}, at: __setup_irq (kernel/irq/internals.h:156 kernel/irq/manage.c:1596)
[    5.428331] #4: ffffff88039c80c8 (lock_class#2){....}-{2:2}, at: __setup_irq (kernel/irq/manage.c:1614)
[    5.436472] stack backtrace:
[    5.439359] CPU: 2 UID: 0 PID: 44 Comm: kworker/u17:1 Tainted: G        W          6.13.0-rc5+ #69
[    5.448690] Tainted: [W]=WARN
[    5.451656] Hardware name: xlnx,zynqmp (DT)
[    5.455845] Workqueue: events_unbound deferred_probe_work_func
[    5.461699] Call trace:
[    5.464147] show_stack+0x18/0x24 C
[    5.467821] dump_stack_lvl (lib/dump_stack.c:123)
[    5.471501] dump_stack (lib/dump_stack.c:130)
[    5.474824] __lock_acquire (kernel/locking/lockdep.c:4828 kernel/locking/lockdep.c:4898 kernel/locking/lockdep.c:5176)
[    5.478758] lock_acquire (arch/arm64/include/asm/percpu.h:40 kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851 kernel/locking/lockdep.c:5814)
[    5.482429] _raw_spin_lock_irqsave (include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162)
[    5.486797] xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8))
[    5.490737] irq_enable (kernel/irq/internals.h:236 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345)
[    5.494060] __irq_startup (kernel/irq/internals.h:241 kernel/irq/chip.c:180 kernel/irq/chip.c:250)
[    5.497645] irq_startup (kernel/irq/chip.c:270)
[    5.501143] __setup_irq (kernel/irq/manage.c:1807)
[    5.504728] request_threaded_irq (kernel/irq/manage.c:2208)


Remediation:
Suricata: Denial of service via SWF decompression
CVE: CVE-2025-64332
Component: Suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-26T22:59:28.497000+00:00

A flaw was found in Suricata. This vulnerability allows a denial of service (DoS) via SWF (Small Web Format) decompression.

Statement: The highest threat of this flaw is to system availability. This issue only affects Suricata installations where SWF decompression is explicitly enabled, as it is disabled by default.

Remediation:
Transformers ReDoS Vulnerability
CVE: CVE-2025-5197
Component: transformers
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-06T11:53:37.232000+00:00

A flaw was found in transformers. The `convert_tf_weight_name_to_pt_weight_name()` function contains a Regular Expression Denial of Service (ReDoS) vulnerability, where a maliciously crafted input string can cause excessive backtracking during regular expression matching. This flaw allows a network-based attacker to trigger this condition by providing a specially designed string as input. This results in a denial of service due to resource exhaustion.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-14933
Component: NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability
Release date: 2025-12-18T21:20:36.889000+00:00

NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of NC variables. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27266.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
tty: serial: ip22zilog: Use platform device for probing
CVE: CVE-2025-68311
Component: kernel
Severity: Moderate
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: ip22zilog: Use platform device for probing

After commit 84a9582fd203 ("serial: core: Start managing serial controllers
to enable runtime PM") serial drivers need to provide a device in
struct uart_port.dev otherwise an oops happens. To fix this issue
for ip22zilog driver switch driver to a platform driver and setup
the serial device in sgi-ip22 code.


Remediation:
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
CVE: CVE-2025-71130
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer

Initialize the eb.vma array with values of 0 when the eb structure is
first set up. In particular, this sets the eb->vma[i].vma pointers to
NULL, simplifying cleanup and getting rid of the bug described below.

During the execution of eb_lookup_vmas(), the eb->vma array is
successively filled up with struct eb_vma objects. This process includes
calling eb_add_vma(), which might fail; however, even in the event of
failure, eb->vma[i].vma is set for the currently processed buffer.

If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which
prompts a call to eb_release_vmas() to clean up the mess. Since
eb_lookup_vmas() might fail during processing any (possibly not first)
buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know
at what point did the lookup function fail.

In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper
function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is
set to NULL in case i915_gem_object_userptr_submit_init() fails; the
current one needs to be cleaned up by eb_release_vmas() at this point,
so the next one is set. If eb_add_vma() fails, neither the current nor
the next vma is set to NULL, which is a source of a NULL deref bug
described in the issue linked in the Closes tag.

When entering eb_lookup_vmas(), the vma pointers are set to the slab
poison value, instead of NULL. This doesn't matter for the actual
lookup, since it gets overwritten anyway, however the eb_release_vmas()
function only recognizes NULL as the stopping value, hence the pointers
are being set to NULL as they go in case of intermediate failure. This
patch changes the approach to filling them all with NULL at the start
instead, rather than handling that manually during failure.

(cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd)


Remediation:
FontForge: Remote Code Execution via SFD file parsing vulnerability
CVE: CVE-2025-15271
Component: fontforge
CWE: CWE-129
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-31T06:58:54.402000+00:00

A flaw was found in FontForge. This vulnerability allows a remote attacker to execute arbitrary code on affected installations. Exploitation requires user interaction, such as opening a malicious SFD (Spline Font Database) file. The issue arises from improper validation of user-supplied data during SFD file parsing, which can lead to a write past the end of an allocated memory array, enabling arbitrary code execution in the context of the current user.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution in FontForge. Exploitation requires user interaction, specifically opening a specially crafted SFD file. This affects FontForge as shipped in Red Hat Enterprise Linux 6 ELS, 7 ELS, 8, 9, 10, Fedora, and Red Hat In-Vehicle OS.

Remediation:
To mitigate this issue, users should exercise caution when handling SFD (Spline Font Database) files from untrusted sources. Avoid opening SFD files from unknown or suspicious origins. If FontForge is not actively used, consider removing the `fontforge` package to eliminate the attack surface. This can be done using `sudo dnf remove fontforge` on Red Hat Enterprise Linux 8, 9, 10, and Fedora, or `sudo yum remove fontforge` on Red Hat Enterprise Linux 6 ELS and 7 ELS. Removing this package will remove FontForge functionality.