huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
drm/amd/pm: fix a potential gpu_metrics_table memory leak
CVE: CVE-2021-4453
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix a potential gpu_metrics_table memory leak

Memory is allocated for gpu_metrics_table in renoir_init_smc_tables(),
but not freed in int smu_v12_0_fini_smc_tables(). Free it!


Remediation:
net: ipv4: fix memory leak in netlbl_cipsov4_add_std
CVE: CVE-2021-47250
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix memory leak in netlbl_cipsov4_add_std

Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888105df7000 (size 64):
comm "syz-executor842", pid 360, jiffies 4294824824 (age 22.546s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]
[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416
[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739
[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800
[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae

The memory of doi_def->map.std pointing is allocated in
netlbl_cipsov4_add_std, but no place has freed it. It should be
freed in cipso_v4_doi_free which frees the cipso DOI resource.


Remediation:
Server: Federated unspecified vulnerability (CPU Jul 2021)
CVE: CVE-2021-2354
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-07-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
dm btree remove: fix use after free in rebalance_children()
CVE: CVE-2021-47600
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dm btree remove: fix use after free in rebalance_children()

Move dm_tm_unlock() after dm_tm_dec().


Remediation:
namespace leak into all other net namespaces
CVE: CVE-2021-46912
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the network sub-component in the Linux Kernel. The tcp_allowed_congestion_control is global and writable, and writing to it in any net namespace will leak into all other net namespaces.


Remediation:
speculative code store bypass (XSA-375)
CVE: CVE-2021-26313
Component: xen
CVSS v3: 6.3/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2021-06-08T00:00:00+00:00

Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arbitrary HTML inject in the group_prefix field
CVE: CVE-2021-3816
Component: cacti
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2021-01-01T00:00:00+00:00

Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vhost-user-gpu: information disclosure due to uninitialized memory read
CVE: CVE-2021-3545
Component: QEMU
CWE: CWE-200
Severity: Low
CVSS v3: 2.4/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Release date: 2021-05-04T00:00:00+00:00

An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.

Statement: This issue does not affect the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8, as Virgl was not enabled in these versions. Support for Virgl was enabled as technical preview in Red Hat Enterprise Linux Advanced Virtualization 8.2, and later disabled in Red Hat Enterprise Linux Advanced Virtualization 8.3.

Remediation:
cmd/go: packages using cgo can cause arbitrary code execution at build time
CVE: CVE-2021-3115
Component: golang
CWE: CWE-94
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-20T00:00:00+00:00

A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: While OpenShift Container Platform (OCP), Red Hat OpenShift Jaeger (RHOSJ),  OpenShift Service Mesh (OSSM)  and OpenShift Virtualization all contain RPMs and containers which are compiled with a vulnerable version of Go, the vulnerability is specific to the building of Go code itself.  Hence the relevant components have been marked as not affected.

Additionally, only the main RPMs and containers for OCP, RHOSJ, OSSM and OpenShift Virtualization are represented due to the large volume of not affected components.

Remediation:
See the documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.5/html/serverless_applications/index
See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index

See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index
See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index

See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index
See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index

See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index
See the Red Hat OpenShift Container Platform 4.6 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index

See the Red Hat OpenShift Container Platform 4.7 documentation at:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index
The flaw can be mitigated by making sure "." is not in your PATH environment variable.
specific configuration allows for a DoS
CVE: CVE-2021-37914
Component: argo-workflows
CVSS v3: 2.7/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2021-08-03T00:00:00+00:00

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Set EXPRESSION_TEMPLATES=false for the workflow controller
basic.py no_log with fallback option
CVE: CVE-2021-20228
Component: ansible
CWE: CWE-522
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-01-29T00:00:00+00:00

A flaw was found in the Ansible Engine, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Deserialization of untrusted data
CVE: CVE-2021-27017
Component: puppet-agent
CWE: CWE-502
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-10T00:00:00+00:00

A flaw was found in puppet-agent. Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
memory: fsl_ifc: fix leak of IO mapping on probe failure
CVE: CVE-2021-47315
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

memory: fsl_ifc: fix leak of IO mapping on probe failure

On probe error the driver should unmap the IO memory.  Smatch reports:

  drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.


Remediation:
CSRF possible under specific conditions
CVE: CVE-2021-45017
Component: catfish
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-12-16T00:00:00+00:00

Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
improper handling of internationalized domain name (IDN) can lead to bypass hostname whitelist validation
CVE: CVE-2021-26539
Component: sanitize-html
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2021-01-22T00:00:00+00:00

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.


Remediation:
For OpenShift Container Platform 4.7, see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html
use-after-free in awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s()
CVE: CVE-2021-42382
Component: busybox
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-11-09T00:00:00+00:00

A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern in the getvar_s function, leading to possible code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Attack complexity is High because it's only exploited with a specially crafted awk pattern under rare conditions.

Remediation:
Out of bounds write in ANGLE
CVE: CVE-2021-30547
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-06-09T00:00:00+00:00

Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
NFC: nci: fix memory leak in nci_allocate_device
CVE: CVE-2021-47180
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the nfc module in the Linux kernel. The nfcmrvl_disconnect function does not free the hci_dev field in the struct nci_dev, causing a memory leak, potentially impacting system performance and resulting in a denial of service.

Statement: The nfc module is not built in the kernel shipped in Red Hat Enterprise Linux, so it is not affected by this vulnerability.

Remediation:
salt-api unauthenticated remote code exec
CVE: CVE-2021-25315
Component: salt
CWE: CWE-94
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-17T00:00:00+00:00

A flaw was found in Salt. This issue is caused by an incorrect implementation of the authentication algorithm, where openSUSE Tumbleweed allows local attackers to execute arbitrary code via Salt without the need to specify valid credentials in Salt versions before 3002.2-3. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
'path' can be pointed to service account token file
CVE: CVE-2021-25745
Component: k8s.io/ingress-nginx
CWE: CWE-73
Severity: Important
CVSS v3: 7.8/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Release date: 2021-01-01T00:00:00+00:00

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.


Remediation:
Block subsystem mishandles reference counts
CVE: CVE-2021-4150
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-09-07T00:00:00+00:00

A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.

Statement: There was no shipped kernel version that was seen affected by this problem.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Crafted PNG grayscale images may lead to out-of-bounds write in heap
CVE: CVE-2021-3695
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's memory, leading to possible code execution and the circumvention of the secure boot mechanism.

Statement: Due to the nature of the input and how it's processed, a successful attack is considered very complex to be executed, as the same value is written out of bounds three times in a row.

Remediation:
Buffer Overflow vulnerability in pdfimages
CVE: CVE-2021-36493
Component: xpdf
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Processing maliciously crafted web content may lead to arbitrary code execution
CVE: CVE-2021-30951
Component: webkitgtk
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A use after free vulnerability was found in webkitgtk. An attacker with network access could pass specially crafted web content files causing an application to halt, crash, or may lead to arbitrary code execution.


Remediation: