huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Node based network policies may incorrectly allow workload traffic
CVE: CVE-2025-30163
Component: cilium
CWE: CWE-863
Severity: Low
CVSS v3: 3.3/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2025-03-24T18:46:35.407000+00:00

A flaw was found in Cilium package. The Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies.

Statement: The vulnerability affects Cilium's node-based network policies (fromNodes and toNodes). The Attack Complexity is set to High (AC:H) because node-based network policy is disabled by default in Cilium. For an attack to succeed, an administrator must first explicitly enable this non-default feature, and the environment must have non-node endpoints sharing specific labels with nodes. Hence, Red Hat rated this vulnerability as Low impact.

Remediation:
Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.
Moby's Firewalld reload makes container ports accessible
CVE: CVE-2025-54388
Component: github.com/moby/moby
CWE: CWE-909
Severity: Moderate
CVSS v3: 5.2/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-30T13:24:06.849000+00:00

A firewall state management issue was found in the Moby project. When the firewalld service is reloaded, it removes all iptables rules, including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
partitions: mac: fix handling of bogus partition table
CVE: CVE-2025-21772
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

partitions: mac: fix handling of bogus partition table

Fix several issues in partition probing:

 - The bailout for a bad partoffset must use put_dev_sector(), since the
   preceding read_part_sector() succeeded.
 - If the partition table claims a silly sector size like 0xfff bytes
   (which results in partition table entries straddling sector boundaries),
   bail out instead of accessing out-of-bounds memory.
 - We must not assume that the partition table contains proper NUL
   termination - use strnlen() and strncmp() instead of strlen() and
   strcmp().


Remediation:
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
CVE: CVE-2025-37976
Component: kernel
Severity: None
CVSS v3: 0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-05-20T00:00:00+00:00

This CVE has been marked as Rejected by the assigning CNA.

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025061801-REJECTED-6bfe@gregkh/

Incorrect use of source-ring fetch function for a destination ring led to invalid pointer access. The patch replaces the call with the correct API to prevent kernel crashes or memory corruption when processing destination ring entries.

Remediation:
Libcoap Use-After-Free Vulnerability
CVE: CVE-2025-50518
Component: libcoap
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-08-14T00:00:00+00:00

A flaw was found in libcoap. The `coap_delete_pdu_lkd` function in `coap_pdu.c` exhibits a use-after-free condition due to improper memory management following the deallocation of a Packet Data Unit (PDU) object. This can allow a local attacker to trigger memory corruption. Exploitation occurs when a freed PDU object is accessed, leading to unpredictable program behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
CVE: CVE-2025-21908
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so
nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.

Otherwise NFS can deadlock waiting for kcompactd enduced writeback which
recurses back to NFS (which triggers writeback to NFSD via NFS loopback
mount on the same host, NFSD blocks waiting for XFS's call to
__filemap_get_folio):

6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.

{---
[58] "kcompactd0"
[<0>] folio_wait_bit+0xe8/0x200
[<0>] folio_wait_writeback+0x2b/0x80
[<0>] nfs_wb_folio+0x80/0x1b0 [nfs]
[<0>] nfs_release_folio+0x68/0x130 [nfs]
[<0>] split_huge_page_to_list_to_order+0x362/0x840
[<0>] migrate_pages_batch+0x43d/0xb90
[<0>] migrate_pages_sync+0x9a/0x240
[<0>] migrate_pages+0x93c/0x9f0
[<0>] compact_zone+0x8e2/0x1030
[<0>] compact_node+0xdb/0x120
[<0>] kcompactd+0x121/0x2e0
[<0>] kthread+0xcf/0x100
[<0>] ret_from_fork+0x31/0x40
[<0>] ret_from_fork_asm+0x1a/0x30
---}

[akpm@linux-foundation.org: fix build]


Remediation:
Linux kernel i40e: Resource exhaustion via unbounded VF filter requests
CVE: CVE-2025-39968
Component: kernel
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-10-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i40e: add max boundary check for VF filters

There is no check for max filters that VF can request. Add it.


Remediation:
Prevent the `i40e` kernel module from loading to mitigate this vulnerability. Create a file `/etc/modprobe.d/i40e-blacklist.conf` with the following content:
```
blacklist i40e
install i40e /bin/true
```
Then, regenerate the initramfs and reboot the system for the changes to take effect. This action will disable the i40e network driver, potentially impacting network functionality if i40e-based network adapters are in use. A system reboot is required for the changes to be fully applied.
aiohttp: Request smuggling vulnerability via non-ASCII decimals in Range header
CVE: CVE-2025-69225
Component: aiohttp
CWE: CWE-444
Severity: Low
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in aiohttp, an asynchronous HTTP client/server framework. The parser logic allows non-ASCII decimal characters in the HTTP Range header. This could potentially enable a remote attacker to exploit a request smuggling vulnerability, leading to the bypass of security controls or unauthorized information access.

Statement: This vulnerability is rated Low for Red Hat products as it affects components utilizing the aiohttp framework, including Red Hat AI Inference Server, Red Hat Ansible Automation Platform, Migration Toolkit for Containers, OpenShift Lightspeed, Hosted OpenShift Clusters, OpenShift Service Mesh, Red Hat Enterprise Linux AI, Red Hat OpenShift AI (RHOAI), and Red Hat Satellite. The flaw in aiohttp's parser logic could enable request smuggling if non-ASCII decimals are present in the HTTP Range header, potentially bypassing security controls or allowing unauthorized information access.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions
CVE: CVE-2025-40148
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions

The function dc_stream_set_cursor_attributes() currently dereferences
the `stream` pointer and nested members `stream->ctx->dc->current_state`
without checking for NULL.

All callers of these functions, such as in
`dcn30_apply_idle_power_optimizations()` and
`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
before calling these functions.

Fixes below:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
error: we previously assumed 'stream' could be null (see line 334)

drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
    327 bool dc_stream_program_cursor_attributes(
    328         struct dc_stream_state *stream,
    329         const struct dc_cursor_attributes *attributes)
    330 {
    331         struct dc  *dc;
    332         bool reset_idle_optimizations = false;
    333
    334         dc = stream ? stream->ctx->dc : NULL;
                     ^^^^^^
The old code assumed stream could be NULL.

    335
--> 336         if (dc_stream_set_cursor_attributes(stream, attributes)) {
                                                    ^^^^^^
The refactor added an unchecked dereference.

drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
   313  bool dc_stream_set_cursor_attributes(
   314          struct dc_stream_state *stream,
   315          const struct dc_cursor_attributes *attributes)
   316  {
   317          bool result = false;
   318
   319          if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
                                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
This function used to check for if stream as NULL and return false at
the start. Probably we should add that back.


Remediation:
Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG
CVE: CVE-2025-11147
Component: apt-cacher-ng
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-09-29T09:26:48.244000+00:00

Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filename>.html”.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-24209
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-04-07T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

A system reboot might be required for this errata to take effect.
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Git GUI can create and overwrite files for which the user has write permission
CVE: CVE-2025-46835
Component: git
CWE: CWE-88
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-07-10T15:09:42.735000+00:00

A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify the content of target files without the affected user's intent, resulting in a data integrity issue.

Statement: Red Hat Product Security team has rated this vulnerability as having a Low severity. The is due to the high complexity in exploiting the vulnerability. Additionally, the user needs to be tricked into cloning an untrusted repository and editing a file located in a directory with a maliciously crafted name.

Remediation:
CVE: CVE-2025-7230
Component: INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability
Release date: 2025-07-07T18:19:13.115000+00:00

INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25723.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer overflow with long TTF font name
CVE: CVE-2025-27833
Component: Ghostscript
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in Artifex Ghostscript. A buffer overflow occurs for a long TTF font name in pdf/pdf_fmap.c.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Input: alps - fix use-after-free bugs caused by dev3_register_work
CVE: CVE-2025-68822
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's ALPS touchpad driver. A race condition exists between device disconnection and the dev3_register_work delayed work item. During disconnect, the alps_data structure can be freed while the delayed work is still executing, causing the work function to access freed memory.

Statement: This requires physical interaction involving an ALPS touchpad with an external PS/2 device and specific timing during device disconnection. The issue was found through static analysis. Systems without ALPS touchpads are unaffected.

Remediation:
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
CVE: CVE-2025-39987
Component: kernel
Severity: None
Release date: 2025-10-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: populate ndo_change_mtu() to prevent buffer overflow

Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.

Unfortunately, because the sun4i_can driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:

  $ ip link set can0 mtu 9999

After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:

	socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))

to inject a malicious CAN XL frames. For example:

	struct canxl_frame frame = {
		.flags = 0xff,
		.len = 2048,
	};

The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:

  1. the skb->protocol is set to ETH_P_CANXL which is valid (the
     function does not check the actual device capabilities).

  2. the length is a valid CAN XL length.

And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is
not able to correctly handle and will thus misinterpret it as a CAN
frame. The driver will consume frame->len as-is with no further
checks.

This can result in a buffer overflow later on in hi3110_hw_tx() on
this line:

	memcpy(buf + HI3110_FIFO_EXT_DATA_OFF,
	       frame->data, frame->len);

Here, frame->len corresponds to the flags field of the CAN XL frame.
In our previous example, we set canxl_frame->flags to 0xff. Because
the maximum expected length is 8, a buffer overflow of 247 bytes
occurs!

Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.


Remediation:
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
CVE: CVE-2025-38695
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure

If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the
resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may
occur before sli4_hba.hdwqs are allocated.  This may result in a null
pointer dereference when attempting to take the abts_io_buf_list_lock for
the first hardware queue.  Fix by adding a null ptr check on
phba->sli4_hba.hdwq and early return because this situation means there
must have been an error during port initialization.

Statement: In the linux kernel lpfc driver for Fibre Channel adapters, a null-pointer dereference can occur during error handling in port initialization. If lpfc_sli4_read_rev() fails before hardware queues are allocated, the cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() attempts to access the first queue lock and crshes, resulting in a denial of service until the driver is restarted.

Remediation:
To mitigate this issue, prevent the lpfc kernel module from being loaded. Please see https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module to prevent it from loading automatically.
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
CVE: CVE-2025-11002
Component: 7zip
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: