huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
arm64: set UXN on swapper page tables
CVE: CVE-2022-50230
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64: set UXN on swapper page tables

[ This issue was fixed upstream by accident in c3cee924bd85 ("arm64:
  head: cover entire kernel image in initial ID map") as part of a
  large refactoring of the arm64 boot flow. This simple fix is therefore
  preferred for -stable backporting ]

On a system that implements FEAT_EPAN, read/write access to the idmap
is denied because UXN is not set on the swapper PTEs. As a result,
idmap_kpti_install_ng_mappings panics the kernel when accessing
__idmap_kpti_flag. Fix it by setting UXN on these PTEs.


Remediation:
Session takeover with OIDC offline refreshtokens
CVE: CVE-2022-3916
Component: keycloak
CWE: CWE-384
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2022-11-09T00:00:00+00:00

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
sql injection
CVE: CVE-2022-45931
Component: opendaylight
CWE: CWE-89
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Release date: 2022-11-16T00:00:00+00:00

A SQL injection issue was discovered in the AAA package of OpenDaylight. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used. This may allow a malicious user to execute arbitrary sql statements against the database.


Remediation:
Use after free in Safe Browsing
CVE: CVE-2022-2604
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-08-02T00:00:00+00:00

Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Authorization Bypass Through User-Controlled Key
CVE: CVE-2022-0639
Component: npm-url-parse
CWE: CWE-639
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2022-02-17T00:00:00+00:00

An authorization bypass flaw was found in url-parse. This flaw allows a local unauthenticated attacker to add an at symbol (@) while submitting a URL. This issue enables the bypass of validation or block-listing restrictions.


Remediation:
For details on how to install and use MTC, refer to:

https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html
Out of bounds read in lg_probe and related functions of hid-lg.c
CVE: CVE-2022-20132
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.5/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-06-01T00:00:00+00:00

An out-of-bounds read flaw was found in the Linux kernel’s hid_is_using_ll_driver function, where the usage was found in how a user inserts a malicious USB device. This flaw allows a local user to access information without the required privileges.


Remediation:
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
CVE: CVE-2022-49011
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A counting logic flaw exists in the Linux kernel. When ci_get_domain_bus_and_slot() is called, it returns a pci device with refcount incremented. When finishing it,
the caller must decrement the reference count by calling pci_dev_put(), leading to the loss of confidentiality of the system.

Statement: This issue is fixed in RHEL-9.4 and above:
~~~
in (rhel-9.4, rhel-9.5, rhel-9.6) hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
~~~
Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: ipw2200: fix memory leak in ipw_wdev_init()
CVE: CVE-2022-50660
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A memory leak vulnerability was found in the ipw2200 wireless driver in the Linux kernel. When an error occurs in ipw_wdev_init(), the allocated memory is not properly freed in the error path. Additionally, ipw_pci_probe() does not release this memory either. Repeated failures can lead to memory exhaustion and system instability.

Statement: This is a memory leak in the ipw2200 wireless driver affecting systems with Intel PRO/Wireless 2200BG/2915ABG adapters. The impact is limited as it requires error conditions during device initialization to trigger.

Remediation:
To mitigate this issue, prevent the ipw2200 module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
use-after-free in O_getOwnPropertyDescriptor() in jsobject.c
CVE: CVE-2022-44789
Component: mujs
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-11-22T00:00:00+00:00

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in Views
CVE: CVE-2022-0793
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-03-01T00:00:00+00:00

Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted Chrome Extension.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Cross-site scripting (XSS) vulnerability in Jenkins LTS
CVE: CVE-2022-34171
Component: Jenkins
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2022-06-22T00:00:00+00:00

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

Statement: This vulnerability affects the Jenkins version 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive). Red Hat products use Jenkins version 2.319 which is NOT affected by this vulnerability.

Remediation:
Authentication bypass
CVE: CVE-2022-0547
Component: openvpn
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2022-01-01T00:00:00+00:00

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
media: v4l2-dv-timings.c: fix too strict blanking sanity checks
CVE: CVE-2022-48987
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-dv-timings.c: fix too strict blanking sanity checks

Sanity checks were added to verify the v4l2_bt_timings blanking fields
in order to avoid integer overflows when userspace passes weird values.

But that assumed that userspace would correctly fill in the front porch,
backporch and sync values, but sometimes all you know is the total
blanking, which is then assigned to just one of these fields.

And that can fail with these checks.

So instead set a maximum for the total horizontal and vertical
blanking and check that each field remains below that.

That is still sufficient to avoid integer overflows, but it also
allows for more flexibility in how userspace fills in these fields.


Remediation:
igb: fix a use-after-free issue in igb_clean_tx_ring
CVE: CVE-2022-49695
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel in the Intel igb driver function igb_clean_tx_ring() when running in XDP mode. A use-after-free issue can arise from attempting to free skb memory using dev_kfree_skb_any(). This issue potentially leads to system instability and memory corruption.

Statement: The bug could happen if 82575/82576 gigabit ethernet family adapters being used and closing device during traffic flow (for example if root user unload driver during heavily usage of IGB network). The security impact is limited, because only privileged user can trigger closing the device.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module igb from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Policy bypass in Service Workers
CVE: CVE-2022-0117
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2022-01-04T00:00:00+00:00

Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
configs are accessible from unprivileged containers in VMs running on VMware products
CVE: CVE-2022-1706
Component: ignition
CWE: CWE-863
Severity: Moderate
CVSS v3: 7.3/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Release date: 2022-05-04T00:00:00+00:00

A vulnerability was found in Ignition, where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets.

Statement: RHCOS may be less impacted than other distros since OCP's default Ignition config only contains a pointer to a config served by the Machine Config Server, and  OCP prevents containers from accessing the MCS directly.  So, the scope on RHCOS should be limited to any VMware users who manually modify the pointer config to include secrets.

Remediation:
For OpenShift Container Platform 4.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html
Possible Workaround: It is not recommended to put secrets in the Ignition config.
mod_proxy_ajp: Possible request smuggling
CVE: CVE-2022-26377
Component: httpd
CWE: CWE-444
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2022-06-08T00:00:00+00:00

An HTTP request smuggling vulnerability was found in the mod_proxy_ajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests.

Statement: The httpd mod_proxy_ajp module is enabled by default on Red Hat Enterprise Linux 8, 9, and in RHSCL. However, there are no directives forwarding requests using the AJP protocol.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Applications using the APR libraries, such as httpd, must be restarted for this update to take effect. After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
Disabling mod_proxy_ajp and restarting httpd will mitigate this flaw.
buffer overflow in ff_hevc_put_hevc_qpel_pixels_8_sse()
CVE: CVE-2022-47664
Component: libde265
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2022-12-18T00:00:00+00:00

Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer overrun in String-to-Float conversion
CVE: CVE-2022-28739
Component: ruby
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-04-14T00:00:00+00:00

A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.


Remediation:
Type Confusion in MathML
CVE: CVE-2022-4912
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-08-30T00:00:00+00:00

Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
CVE: CVE-2022-49380
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()

As Yanming reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215897

I have encountered a bug in F2FS file system in kernel v5.17.

The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can
reproduce the bug by running the following commands:

The kernel message is shown below:

kernel BUG at fs/f2fs/f2fs.h:2511!
Call Trace:
 f2fs_remove_inode_page+0x2a2/0x830
 f2fs_evict_inode+0x9b7/0x1510
 evict+0x282/0x4e0
 do_unlinkat+0x33a/0x540
 __x64_sys_unlinkat+0x8e/0xd0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The root cause is: .total_valid_block_count or .total_valid_node_count
could fuzzed to zero, then once dec_valid_node_count() was called, it
will cause BUG_ON(), this patch fixes to print warning info and set
SBI_NEED_FSCK into CP instead of panic.


Remediation:
cpu: Intel: information disclosure via local access
CVE: CVE-2022-28693
Component: hw
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-07-13T00:00:00+00:00

A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to enable information disclosure via local access.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
octeontx2-pf: Fix potential memory leak in otx2_init_tc()
CVE: CVE-2022-48968
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the rvu_nicpf module in the Linux kernel. A memory leak can occur due to an improper error handling, potentially impacting system performance and possibly resulting in a denial of service.

Statement: The rvu_nicpf module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and 9 is not affected by this vulnerability, in RHEL-8 the module is not built and in RHEL-9 the fix was already applied.

Remediation: