huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
platform/chrome: cros_ec_typec: zero out stale pointers
CVE: CVE-2022-50642
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A use-after-free vulnerability exists in the Chrome EC Type-C driver in the Linux kernel. When cros_typec_get_switch_handles() fails to obtain switch handles, it frees allocated pointers but doesn't zero them out. These stale pointers can later be dereferenced, causing use-after-free or double-free conditions.

Statement: This vulnerability is specific to ChromeOS/Chromebook hardware using the Chrome Embedded Controller for USB Type-C management. Standard Linux systems without this hardware are unaffected.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
CVE: CVE-2022-49199
Component: kernel
CWE: CWE-191
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()

This code checks "index" for an upper bound but it does not check for
negatives.  Change the type to unsigned to prevent underflows.

Statement: The bug could happen only if RDMA being used (that is Remote Direct Memory Access). The security impact is limited, because it is integer underflow bug that does not lead to an actual kernel panic or other fail. It can lead to incorrect behavior of RDMA (for example to incorrect statistics counters value or similar).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module ib_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
CVE: CVE-2022-49463
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe

of_find_node_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.


Remediation:
use after free in function qf_buf_add_line( )
CVE: CVE-2022-3037
Component: vim
CWE: CWE-416
Severity: Low
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-08-30T00:00:00+00:00

A flaw was found in vim, where it is vulnerable to a use-after-free in the qf_buf_add_line() function. This flaw allows a specially crafted file to crash a program, use unexpected values, or execute code.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Remediation:
RDMA/hns: Fix NULL pointer problem in free_mr_init()
CVE: CVE-2022-49930
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix NULL pointer problem in free_mr_init()

Lock grab occurs in a concurrent scenario, resulting in stepping on a NULL
pointer.  It should be init mutex_init() first before use the lock.

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  Call trace:
   __mutex_lock.constprop.0+0xd0/0x5c0
   __mutex_lock_slowpath+0x1c/0x2c
   mutex_lock+0x44/0x50
   free_mr_send_cmd_to_hw+0x7c/0x1c0 [hns_roce_hw_v2]
   hns_roce_v2_dereg_mr+0x30/0x40 [hns_roce_hw_v2]
   hns_roce_dereg_mr+0x4c/0x130 [hns_roce_hw_v2]
   ib_dereg_mr_user+0x54/0x124
   uverbs_free_mr+0x24/0x30
   destroy_hw_idr_uobject+0x38/0x74
   uverbs_destroy_uobject+0x48/0x1c4
   uobj_destroy+0x74/0xcc
   ib_uverbs_cmd_verbs+0x368/0xbb0
   ib_uverbs_ioctl+0xec/0x1a4
   __arm64_sys_ioctl+0xb4/0x100
   invoke_syscall+0x50/0x120
   el0_svc_common.constprop.0+0x58/0x190
   do_el0_svc+0x30/0x90
   el0_svc+0x2c/0xb4
   el0t_64_sync_handler+0x1a4/0x1b0
   el0t_64_sync+0x19c/0x1a0


Remediation:
heap memory corruption on gdk-pixbuf
CVE: CVE-2022-48622
Component: gnome
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in GNOME's GdkPixbuf library, a library used to load image data in various formats used by GDK for handling graphical assets. This issue occurs when loading a crafted ANI (animated cursor file) file, which may lead to a heap based out-of-bounds write, causing memory corruption. When a successful attack is in place, it can lead to a denial of service or in some cases arbitrary code execution.

Statement: The vulnerability in the GdkPixbuf library, allowing for heap-based out-of-bounds writes when loading crafted ANI files, poses a moderate severity risk. While the flaw could lead to memory corruption and potential denial of service or arbitrary code execution, its impact is somewhat mitigated by factors such as the need for the attacker to craft specifically malicious ANI files and the requirement for user interaction to open these files. Additionally, exploitation is limited to systems where GdkPixbuf is used to handle ANI files, reducing the overall attack surface.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
This flaw can be mitigated by the user avoiding to load .ani files from untrusted sources.
Privileged Escalation in Kubernetes Gateway API
CVE: CVE-2022-21701
Component: istio
CWE: CWE-1220
Severity: Moderate
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-18T00:00:00+00:00

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this privilege to create other resources that they may not have access to, such as `Pod`. This vulnerability impacts only an Alpha level feature, the Kubernetes Gateway API. This is not the same as the Istio Gateway type (gateways.networking.istio.io), which is not vulnerable. Users are advised to upgrade to resolve this issue. Users unable to upgrade should implement any of the following which will prevent this vulnerability: Remove the gateways.gateway.networking.k8s.io CustomResourceDefinition, set PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER=true environment variable in Istiod, or remove CREATE permissions for gateways.gateway.networking.k8s.io objects from untrusted users.


Remediation:
snyk-hex-plugin: command injection
CVE: CVE-2022-22984
Component: snyk
CWE: CWE-77
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2022-11-30T00:00:00+00:00

A vulnerability was found in the snyk-hex-plugin for snyk. This issue allows an attacker to run arbitrary commands on the host system where the Snyk CLI is installed by passing crafted command line flags.


Remediation:
nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE: CVE-2022-48788
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

A use after free vulnerability was found in the transport error_recovery. When nvme_rdma_submit_async is checking the ctrl and queue state before preparing the AER command and scheduling, io_work,recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
server crash in Item_args::walk_args
CVE: CVE-2022-32087
Component: mariadb
CWE: CWE-229
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
Server: Optimizer unspecified vulnerability (CPU Jan 2022)
CVE: CVE-2022-21351
Component: mysql
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2022-01-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
memory leak in find_abstract_instance() in dwarf2.c
CVE: CVE-2022-48065
Component: binutils
Severity: Low
Release date: 2022-12-21T00:00:00+00:00

A memory leak vulnerability was found in GNU Binutils, particularly in the function find_abstract_instance() in dwarf2.c. This flaw could be exploited by an attacker who provides a specially crafted input, potentially leading to a denial of service condition due to the continuous consumption of memory resources.


Remediation:
tulip: DMA reentrancy issue leads to stack or heap overflow
CVE: CVE-2022-2962
Component: QEMU
CWE: CWE-662
Severity: Low
CVSS v3: 5.2/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2022-08-23T00:00:00+00:00

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its MMIO address. This issue can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. This flaw allows a malicious guest to crash the QEMU process on the host, resulting in a denial of service condition.

Statement: The `qemu-kvm` packages as shipped with Red Hat Enterprise Linux 8 Advanced Virtualization and Red Hat Enterprise Linux 6, 7, 8 are not affected by this issue as the Tulip NIC device is not included.

Remediation:
Out-of-Bound Read in xrdp_caps_process_confirm_active()
CVE: CVE-2022-23481
Component: xrdp
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2022-12-09T00:00:00+00:00

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Device Mapper RAID out-of-bounds access
CVE: CVE-2022-49674
Component: kernel
CWE: CWE-805
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's device mapper (dm) RAID component. This vulnerability allows an attacker to cause an out-of-bounds memory access via loading a crafted dm-raid table. This may lead to a crash.

Statement: The highest threat of this flaw is to system availability. A local attacker could trigger an out-of-bounds access in the dm-raid module by loading a specially crafted dm-raid table, leading to a system crash.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
CVE: CVE-2022-48966
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mvneta: Prevent out of bounds read in mvneta_config_rss()

The pp->indir[0] value comes from the user.  It is passed to:

	if (cpu_online(pp->rxq_def))

inside the mvneta_percpu_elect() function.  It needs bounds checkeding
to ensure that it is not beyond the end of the cpu bitmap.


Remediation:
heap buffer overflow
CVE: CVE-2022-2061
Component: chafa
CVSS v3: 2.9/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2022-06-13T00:00:00+00:00

Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer overflow when loading crafted EFI images
CVE: CVE-2022-28737
Component: shim
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-06-07T17:00:00+00:00

A flaw was found in shim during the handling of EFI executables. A crafted EFI image can lead to an overflow in shim. This flaw allows an attacker to perform an out-of-bounds write in memory. A successful attack can lead to data integrity, confidentiality issues, and arbitrary code execution.


Remediation:
power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
CVE: CVE-2022-49224
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

kobject_init_and_add() takes reference even when it fails.
According to the doc of kobject_init_and_add()：

   If this function returns an error, kobject_put() must be called to
   properly clean up the memory associated with the object.

Fix memory leak by calling kobject_put().


Remediation:
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
CVE: CVE-2022-50005
Component: kernel
CWE: CWE-826
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout

When the pn532 uart device is detaching, the pn532_uart_remove()
is called. But there are no functions in pn532_uart_remove() that
could delete the cmd_timeout timer, which will cause use-after-free
bugs. The process is shown below:

    (thread 1)                  |        (thread 2)
                                |  pn532_uart_send_frame
pn532_uart_remove               |    mod_timer(&pn532->cmd_timeout,...)
  ...                           |    (wait a time)
  kfree(pn532) //FREE           |    pn532_cmd_timeout
                                |      pn532_uart_send_frame
                                |        pn532->... //USE

This patch adds del_timer_sync() in pn532_uart_remove() in order to
prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc()
is well synchronized, it sets nfc_dev->shutting_down to true and there
are no syscalls could restart the cmd_timeout timer.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
out of bounds read in current_quote()
CVE: CVE-2022-2124
Component: vim
CWE: CWE-126
Severity: Low
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-06-19T00:00:00+00:00

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Red Hat Enterprise Linux 6 and 7 are out of support scope for this flaw. To learn more about RHEL support scopes, please see https://access.redhat.com/support/policy/updates/errata/ .

Remediation:
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
CVE: CVE-2022-50510
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A resource-handling flaw was found in the Linux kernel performance monitoring driver for ARM System Memory Management Unit version 3 in the way hotplug callbacks are registered during driver initialization. If driver registration fails, previously added CPU hotplug callbacks are not removed, leaving leaked callbacks behind. A local user could use this flaw to destabilize the system, resulting in a denial of service.

Statement: arm_smmu_pmu_init() added multi-CPU hotplug callbacks but did not remove them on a subsequent platform driver registration failure. The correction removes the registered callbacks in the failure path so that no dangling hotplug handlers remain after an init error.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module arm_smmuv3_pmu from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
heap-buffer-overflow in sdp_parse() in sdp_parse.c
CVE: CVE-2022-31003
Component: sofia-sip
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Release date: 2022-05-31T00:00:00+00:00

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
CVE: CVE-2022-49731
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the libata module in the Linux kernel. A NULL pointer dereference can be triggered in the unlikely case that the PPI, an array of ATA port_info, argument of the ata_host_alloc_pinfo function is NULL. This issue causes a crash and results in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.3 via RHSA-2023:6583 [1].

[1]. https://access.redhat.com/errata/RHSA-2023:6583

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.