huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
CVE: CVE-2021-47392
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure

If cma_listen_on_all() fails it leaves the per-device ID still on the
listen_list but the state is not set to RDMA_CM_ADDR_BOUND.

When the cmid is eventually destroyed cma_cancel_listens() is not called
due to the wrong state, however the per-device IDs are still holding the
refcount preventing the ID from being destroyed, thus deadlocking:

 task:rping state:D stack:   0 pid:19605 ppid: 47036 flags:0x00000084
 Call Trace:
  __schedule+0x29a/0x780
  ? free_unref_page_commit+0x9b/0x110
  schedule+0x3c/0xa0
  schedule_timeout+0x215/0x2b0
  ? __flush_work+0x19e/0x1e0
  wait_for_completion+0x8d/0xf0
  _destroy_id+0x144/0x210 [rdma_cm]
  ucma_close_id+0x2b/0x40 [rdma_ucm]
  __destroy_id+0x93/0x2c0 [rdma_ucm]
  ? __xa_erase+0x4a/0xa0
  ucma_destroy_id+0x9a/0x120 [rdma_ucm]
  ucma_write+0xb8/0x130 [rdma_ucm]
  vfs_write+0xb4/0x250
  ksys_write+0xb5/0xd0
  ? syscall_trace_enter.isra.19+0x123/0x190
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Ensure that cma_listen_on_all() atomically unwinds its action under the
lock during error.


Remediation:
net: ipv4: fix memory leak in ip_mc_add1_src
CVE: CVE-2021-47238
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's IPv4 code, within the ip_mc_add1_src function. This issue can lead to a memory leak, where certain memory resources are not properly released when a network interface is removed, resulting in increased memory usage and potential performance issues over time.


Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Race leads to panic in oneshot::Sender::send()
CVE: CVE-2021-45710
Component: tokio
CWE: CWE-362
Severity: Low
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2021-12-27T00:00:00+00:00

A flaw was found in the tokio crate for Rust. In circumstances involving a closed oneshot channel, there is a data race and memory corruption issue.


Remediation:
Use after free in Extensions API
CVE: CVE-2021-30610
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-08-31T00:00:00+00:00

Chromium: CVE-2021-30610 Use after free in Extensions API

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
potential SQL injection via unsanitized QuerySet.order_by() input
CVE: CVE-2021-35042
Component: django
CWE: CWE-89
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-07-01T08:00:00+00:00

A flaw was found in django. Unsanitized user input passed to ``QuerySet.order_by()`` could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probe
CVE: CVE-2021-46995
Component: kernel
CWE: CWE-822
Severity: Low
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probe

When we converted this code to use dev_err_probe() we accidentally
removed a return. It means that if devm_clk_get() it will lead to an
Oops when we call clk_get_rate() on the next line.


Remediation:
specially crafted HTTP request may cause an authentication bypass
CVE: CVE-2021-41303
Component: shiro
CWE: CWE-287
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-09-16T00:00:00+00:00

A flaw was found in Apache Shiro. When using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. The highest threat from this vulnerability is to data confidentiality, integrity as well as system availability.

Statement: Although Red Hat OpenStack Platform's OpenDaylight includes the affected code, the vulnerable function is not used, therefore, not exploitable. For this reason, the RHOSP impact is low, and no update will be provided at this time for OpenDaylight.

Remediation:
QXL: double fetch in qxl_cursor() can lead to heap buffer overflow
CVE: CVE-2021-4207
Component: QEMU
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

Statement: Releases of Red Hat OpenStack Platform 15 and newer consume fixes directly from the Red Hat Enterprise Linux 8 Advanced Virtualization repository. A future update may address this issue in Red Hat Enterprise Linux 8 and RHEL 8 Advanced Virtualization. The versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 9 are not affected by this flaw as they do not include support for QXL display device emulation.

Remediation:
Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket
CVE: CVE-2021-3468
Component: avahi
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-03-10T00:00:00+00:00

A flaw was found in avahi. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
integer wraparound in the GIF loader of gdk-pixbuf via crafted input leads to segmentation fault
CVE: CVE-2021-20240
Component: gdk-pixbuf
CWE: CWE-787
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-19T00:00:00+00:00

A flaw was found in gdk-pixbuf. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded. An attacker may cause applications to crash or could potentially execute code on the victim system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue did not affect the versions of gdk-pixbuf2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code.

Remediation:
DNS rebinding vulnerability
CVE: CVE-2021-4138
Component: geckodriver
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2021-09-16T00:00:00+00:00

Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.


Remediation:
an assertion failure in a primary server by sending a non-administrative command
CVE: CVE-2021-31294
Component: redis
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the Redis package. If a replica sends a SET command to its master during a failover, the master crashes on assertion.


Remediation:
Use of Unmaintained Third Party Components
CVE: CVE-2021-22142
Component: kibana
CWE: CWE-1021
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-05-25T00:00:00+00:00

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses. An attacker potentially is able to leverage known Chromium vulnerabilities to conduct further attacks.

Statement: The kibana reporting feature is part of the X-Pack features [1].
In OpenShift Container Platform (OCP) the kibana components have X-Pack security features disabled by default. The X-Pack plugin can be used only in the enterprise version [2] [3].
Hence the open source version is unaffected by this vulnerability.

[1] https://www.elastic.co/guide/en/kibana/current/reporting-getting-started.html
[2] https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-xpack.html
[3] https://www.elastic.co/subscriptions

Remediation:
prototype pollution may lead to DoS or remote code execution
CVE: CVE-2021-3757
Component: nodejs-immer
CWE: CWE-915
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-08-30T00:00:00+00:00

A flaw was found in immer when manipulates object attributes such as _proto_, constructor and prototype. An attacker can manipulate these values by overwriting and polluting them. Those attributes would be inherited by JavaScript objects which could trigger exception handlers and leading into a denial of service attack.

Statement: In OpenShift Container Platform (OCP) and OpenShift Migration Toolkit for Containers (MTC), the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-immer library to authenticated users only, therefore the impact is Low.

Remediation:
For details on how to install and use MTC, refer to:

https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html
block: don't call rq_qos_ops->done_bio if the bio isn't tracked
CVE: CVE-2021-47412
Component: kernel
CWE: CWE-388
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel, where improper handling of block I/O requests when a block I/O request (bio) is not tracked, the kernel erroneously calls the rq_qos_ops->done_bio function, potentially leading to use-after-free issues. This situation can occurr when the request queue is accessed after it has been freed, resulting in possible kernel panic.

Statement: This vulnerability is classified as moderate severity, as the issue can cause kernel panics, leading to system crashes. However, it does not affect data confidentiality or integrity.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
drm/amd/display: Free local data after use
CVE: CVE-2021-47042
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Free local data after use

Fixes the following memory leak in dc_link_construct():

unreferenced object 0xffffa03e81471400 (size 1024):
comm "amd_module_load", pid 2486, jiffies 4294946026 (age 10.544s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000000bdf5c4a>] kmem_cache_alloc_trace+0x30a/0x4a0
[<00000000e7c59f0e>] link_create+0xce/0xac0 [amdgpu]
[<000000002fb6c072>] dc_create+0x370/0x720 [amdgpu]
[<000000000094d1f3>] amdgpu_dm_init+0x18e/0x17a0 [amdgpu]
[<00000000bec048fd>] dm_hw_init+0x12/0x20 [amdgpu]
[<00000000a2bb7cf6>] amdgpu_device_init+0x1463/0x1e60 [amdgpu]
[<0000000032d3bb13>] amdgpu_driver_load_kms+0x5b/0x330 [amdgpu]
[<00000000a27834f9>] amdgpu_pci_probe+0x192/0x280 [amdgpu]
[<00000000fec7d291>] local_pci_probe+0x47/0xa0
[<0000000055dbbfa7>] pci_device_probe+0xe3/0x180
[<00000000815da970>] really_probe+0x1c4/0x4e0
[<00000000b4b6974b>] driver_probe_device+0x62/0x150
[<000000000f9ecc61>] device_driver_attach+0x58/0x60
[<000000000f65c843>] __driver_attach+0xd6/0x150
[<000000002f5e3683>] bus_for_each_dev+0x6a/0xc0
[<00000000a1cfc897>] driver_attach+0x1e/0x20


Remediation:
stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp
CVE: CVE-2021-32142
Component: LibRaw
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the LibRaw package. A stack buffer overflow in the LibRaw_buffer_datastream::gets() function in src/libraw_datastream.cpp caused by a maliciously crafted file may result in compromised confidentiality and integrity and an application crash.


Remediation:
multiple vulnerabilities
CVE: CVE-2021-30485
Component: ezXML
Release date: 2021-01-01T00:00:00+00:00

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp() on a NULL pointer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Options unspecified vulnerability (CPU Apr 2021)
CVE: CVE-2021-2146
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-04-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
arm: SIGPAGE information disclosure vulnerability
CVE: CVE-2021-21781
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2021-06-25T00:00:00+00:00

An information disclosure flaw exists in the ARM SIGPAGE functionality of the Linux kernel. An attacker with a local account can read the contents of the sigpage, which contains previously initialized kernel memory contents. This flaw requires an attacker to read a process’s memory at a specific offset to trigger this vulnerability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/sched: sch_ets: don't peek at classes beyond 'nbands'
CVE: CVE-2021-47557
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's net/sched implementation, in the ETS module, where the system attempts to access classes beyond the defined limits, leading to a potential NULL pointer dereference. As a result, this can cause system crashes, disrupt network traffic.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Possible DoS Vulnerability in Action Controller Token Authentication
CVE: CVE-2021-22904
Component: rails
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-05-05T00:00:00+00:00

A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller.

Statement: Red Hat CloudForms 5.0 (CFME 5.11) is in the maintenance phase and we will not be fixing Medium/Low impact security bugs. Reference: https://access.redhat.com/support/policy/updates/cloudforms

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
NFSD: Fix READDIR buffer overflow
CVE: CVE-2021-47107
Component: kernel
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix READDIR buffer overflow

If a client sends a READDIR count argument that is too small (say,
zero), then the buffer size calculation in the new init_dirlist
helper functions results in an underflow, allowing the XDR stream
functions to write beyond the actual buffer.

This calculation has always been suspect. NFSD has never sanity-
checked the READDIR count argument, but the old entry encoders
managed the problem correctly.

With the commits below, entry encoding changed, exposing the
underflow to the pointer arithmetic in xdr_reserve_space().

Modern NFS clients attempt to retrieve as much data as possible
for each READDIR request. Also, we have no unit tests that
exercise the behavior of READDIR at the lower bound of @count
values. Thus this case was missed during testing.

Statement: Red Hat Product Security has rated this bug as moderate as the out of box configuration of NFS protects the process from arbitrary code execution scenarios. There is a risk to availablity on successful exploitation of this bug.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
two-factor authentication not enforced for pages marked as public
CVE: CVE-2021-41179
Component: nextcloud
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-10-25T00:00:00+00:00

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crafted URIs allow bypassing security constraints
CVE: CVE-2021-34429
Component: jetty
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2021-07-15T00:00:00+00:00

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Statement: OCP 3.11 is out of the support scope for Moderate and Low impact vulnerabilities because is already in the Maintenance Support phase, hence the affected OCP 3.11 component has been marked as "ooss".

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).