huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Segmentation violation via FNT_Size_Request
CVE: CVE-2022-27405
Component: FreeType
CWE: CWE-824
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Release date: 2022-04-22T00:00:00+00:00

A segmentation fault was found in the FreeType library. This flaw allows an attacker to attempt access to a memory location in a way that could cause an application to halt or crash, leading to a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The X server must be restarted (log out, then log back in) for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The X server must be restarted (log out, then log back in) for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The X server must be restarted (log out, then log back in) for this update to take effect.
vme: Fix error not catched in fake_init()
CVE: CVE-2022-50538
Component: kernel
Severity: None
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vme: Fix error not catched in fake_init()

In fake_init(), __root_device_register() is possible to fail but it's
ignored, which can cause unregistering vme_root fail when exit.

 general protection fault,
 probably for non-canonical address 0xdffffc000000008c
 KASAN: null-ptr-deref in range [0x0000000000000460-0x0000000000000467]
 RIP: 0010:root_device_unregister+0x26/0x60
 Call Trace:
  <TASK>
  __x64_sys_delete_module+0x34f/0x540
  do_syscall_64+0x38/0x90
  entry_SYSCALL_64_after_hwframe+0x63/0xcd

Return error when __root_device_register() fails.


Remediation:
irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
CVE: CVE-2022-49719
Component: kernel
CWE: CWE-402
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic/realview: Fix refcount leak in realview_gic_of_init

of_find_matching_node_and_match() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.


Remediation:
RDMA/hfi1: Fix use-after-free bug for mm struct
CVE: CVE-2022-49076
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hfi1: Fix use-after-free bug for mm struct

Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages().  A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write().  Another is corruption of an mm struct that is
in use by another task.


Remediation:
netfilter: nf_conntrack_irc message handling issue
CVE: CVE-2022-2663
Component: kernel
CWE: CWE-923
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2022-08-30T00:00:00+00:00

A flaw was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nf_conntrack_irc configured.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this issue, prevent the module nf_conntrack_irc from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
CVE: CVE-2022-39374
Component: matrix-synapse
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iommu/arm-smmu-v3-sva: Fix mm use-after-free
CVE: CVE-2022-49426
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu-v3-sva: Fix mm use-after-free

We currently call arm64_mm_context_put() without holding a reference to
the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to
ensure the mm only gets freed after we unpinned the ASID.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
bpf: Don't redirect packets with invalid pkt_len
CVE: CVE-2022-49975
Component: kernel
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't redirect packets with invalid pkt_len

Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any
skbs, that is, the flow->head is null.
The root cause, as the [2] says, is because that bpf_prog_test_run_skb()
run a bpf prog which redirects empty skbs.
So we should determine whether the length of the packet modified by bpf
prog or others like bpf_prog_test is valid before forwarding it directly.


Remediation:
smb3: fix temporary data corruption in insert range
CVE: CVE-2022-48667
Component: kernel
CWE: CWE-696
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2022-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's Server Message Block version 3 (SMB3 ) protocol, specifically related to the insert range operation. This issue occurs when cached regions affected by the insert range operation are not properly discarded, which could lead to temporary file data corruption.

Statement: The problem was resolved by making sure that the affected cached regions are handled correctly to prevent data corruption. Additionally, some minor code cleanup was included to improve efficiency, such as reducing unnecessary inode size rereads.

Remediation:
drm/drv: Fix potential memory leak in drm_dev_init()
CVE: CVE-2022-49830
Component: kernel
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/drv: Fix potential memory leak in drm_dev_init()

drm_dev_init() will add drm_dev_init_release() as a callback. When
drmm_add_action() failed, the release function won't be added. As the
result, the ref cnt added by device_get() in drm_dev_init() won't be put
by drm_dev_init_release(), which leads to the memleak. Use
drmm_add_action_or_reset() instead of drmm_add_action() to prevent
memleak.

unreferenced object 0xffff88810bc0c800 (size 2048):
  comm "modprobe", pid 8322, jiffies 4305809845 (age 15.292s)
  hex dump (first 32 bytes):
    e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00  ................
    20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff   $<.............
  backtrace:
    [<000000007251f72d>] __kmalloc+0x4b/0x1c0
    [<0000000045f21f26>] platform_device_alloc+0x2d/0xe0
    [<000000004452a479>] platform_device_register_full+0x24/0x1c0
    [<0000000089f4ea61>] 0xffffffffa0736051
    [<00000000235b2441>] do_one_initcall+0x7a/0x380
    [<0000000001a4a177>] do_init_module+0x5c/0x230
    [<000000002bf8a8e2>] load_module+0x227d/0x2420
    [<00000000637d6d0a>] __do_sys_finit_module+0xd5/0x140
    [<00000000c99fc324>] do_syscall_64+0x3f/0x90
    [<000000004d85aa77>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Statement: This patch fixes a potential memory leak in drm_dev_init() caused by failure in drmm_add_action(). If this call fails, the release function is not registered, and the reference count incremented by device_get() is never released — leading to a memory leak. Replacing drmm_add_action() with drmm_add_action_or_reset() ensures cleanup is triggered correctly on failure. Without the fix, failing to register a cleanup handler can result in unreferenced memory being leaked during device initialization, especially during module load via modprobe.

Remediation:
net: ieee802154: ca8210: Stop leaking skb&#39;s
CVE: CVE-2022-48722
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ieee802154: ca8210: Stop leaking skb's

Upon error the ieee802154_xmit_complete() helper is not called. Only
ieee802154_wake_queue() is called manually. We then leak the skb
structure.

Free the skb structure upon error before returning.


Remediation:
data races around sk->sk_prot
CVE: CVE-2022-3567
Component: kernel
CWE: CWE-421
Severity: Moderate
CVSS v3: 6.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2022-10-06T00:00:00+00:00

A data race problem was found in sk->sk_prot in the network subsystem in ipv6 in the Linux kernel. This issue occurs while some functions access critical data, leading to a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
i40e: Fix kernel crash during module removal
CVE: CVE-2022-48688
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the i40e module in the Linux kernel. A NULL pointer dereference can be triggered when the module is removed, causing a kernel crash and resulting in a denial of service.

Statement: This vulnerability does not affect the i40e module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 and 9 because it already contains the fix for this issue.

Remediation:
Race condition in roccat_report_event in drivers/hid/hid-roccat.c
CVE: CVE-2022-41850
Component: kernel
CWE: CWE-366
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-09-30T00:00:00+00:00

A race issue was found in roccat_report_event in drivers/hid/hid-roccat.c in the Human Interface Devices (HID) sub-component in the Linux kernel. This flaw allows a local attacker with a standard user privilege to cause a denial of service.


Remediation:
This flaw can be mitigated by preventing the affected USB Roccat kernel module from loading during the boot time. Ensure the module is added into the blacklist file.
~~~
Refer:  
How do I blacklist a kernel module to prevent it from loading automatically? 
https://access.redhat.com/solutions/41278
~~~
use of uninitialized function pointer
CVE: CVE-2022-1809
Component: radare2
CVSS v3: 4.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2022-05-22T00:00:00+00:00

Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drivers: serial: jsm: fix some leaks in probe
CVE: CVE-2022-50312
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drivers: serial: jsm: fix some leaks in probe

This error path needs to unwind instead of just returning directly.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
drm/amdkfd: svm range restore work deadlock when process exit
CVE: CVE-2022-49133
Component: kernel
Severity: None
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: svm range restore work deadlock when process exit

kfd_process_notifier_release flush svm_range_restore_work
which calls svm_range_list_lock_and_flush_work to flush deferred_list
work, but if deferred_list work mmput release the last user, it will
call exit_mmap -> notifier_release, it is deadlock with below backtrace.

Move flush svm_range_restore_work to kfd_process_wq_release to avoid
deadlock. Then svm_range_restore_work take task->mm ref to avoid mm is
gone while validating and mapping ranges to GPU.

Workqueue: events svm_range_deferred_list_work [amdgpu]
Call Trace:
 wait_for_completion+0x94/0x100
 __flush_work+0x12a/0x1e0
 __cancel_work_timer+0x10e/0x190
 cancel_delayed_work_sync+0x13/0x20
 kfd_process_notifier_release+0x98/0x2a0 [amdgpu]
 __mmu_notifier_release+0x74/0x1f0
 exit_mmap+0x170/0x200
 mmput+0x5d/0x130
 svm_range_deferred_list_work+0x104/0x230 [amdgpu]
 process_one_work+0x220/0x3c0


Remediation:
SSH Authorization Socket Hijacking
CVE: CVE-2022-24950
Component: eternalterminal
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-08-16T00:00:00+00:00

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service via refcount leak in ocxl afu_ioctl()
CVE: CVE-2022-50742
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's `misc: ocxl` component. A local attacker with low privileges could exploit a reference count leak in the `afu_ioctl()` function. This flaw occurs when `ocxl_irq_set_handler` fails to call `eventfd_ctx_put` to release a reference count obtained by `eventfd_ctx_fdget`. This could lead to a denial of service (DoS) due to resource exhaustion.


Remediation:
Drivers: hv: vmbus: Fix initialization of device object in vmbus_device_register()
CVE: CVE-2022-49099
Component: kernel
CWE: CWE-1188
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Fix initialization of device object in vmbus_device_register()

Initialize the device's dma_{mask,parms} pointers and the device's
dma_mask value before invoking device_register().  Address the
following trace with 5.17-rc7:

[   49.646839] WARNING: CPU: 0 PID: 189 at include/linux/dma-mapping.h:543
	netvsc_probe+0x37a/0x3a0 [hv_netvsc]
[   49.646928] Call Trace:
[   49.646930]  <TASK>
[   49.646935]  vmbus_probe+0x40/0x60 [hv_vmbus]
[   49.646942]  really_probe+0x1ce/0x3b0
[   49.646948]  __driver_probe_device+0x109/0x180
[   49.646952]  driver_probe_device+0x23/0xa0
[   49.646955]  __device_attach_driver+0x76/0xe0
[   49.646958]  ? driver_allows_async_probing+0x50/0x50
[   49.646961]  bus_for_each_drv+0x84/0xd0
[   49.646964]  __device_attach+0xed/0x170
[   49.646967]  device_initial_probe+0x13/0x20
[   49.646970]  bus_probe_device+0x8f/0xa0
[   49.646973]  device_add+0x41a/0x8e0
[   49.646975]  ? hrtimer_init+0x28/0x80
[   49.646981]  device_register+0x1b/0x20
[   49.646983]  vmbus_device_register+0x5e/0xf0 [hv_vmbus]
[   49.646991]  vmbus_add_channel_work+0x12d/0x190 [hv_vmbus]
[   49.646999]  process_one_work+0x21d/0x3f0
[   49.647002]  worker_thread+0x4a/0x3b0
[   49.647005]  ? process_one_work+0x3f0/0x3f0
[   49.647007]  kthread+0xff/0x130
[   49.647011]  ? kthread_complete_and_exit+0x20/0x20
[   49.647015]  ret_from_fork+0x22/0x30
[   49.647020]  </TASK>
[   49.647021] ---[ end trace 0000000000000000 ]---


Remediation:
crypto: qat - add param check for RSA
CVE: CVE-2022-49563
Component: kernel
CWE: CWE-191
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - add param check for RSA

Reject requests with a source buffer that is bigger than the size of the
key. This is to prevent a possible integer underflow that might happen
when copying the source scatterlist into a linear buffer.


Remediation:
crash in Used_tables_and_const_cache::used_tables_and_const_cache_join
CVE: CVE-2022-27385
Component: mariadb
CWE: CWE-89
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in MariaDB. An issue in the component, Used_tables_and_const_cache::used_tables_and_const_cache_join, of the MariaDB Server v10.7 allows attackers to cause a denial of service (DoS) via specially crafted SQL statements, impacting availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
Heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer leading to arbitrary code execution
CVE: CVE-2022-30293
Component: webkitgtk
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-05-06T00:00:00+00:00

A heap buffer overflow vulnerability was found in WebKitGTK. The vulnerability occurs when processing or rendering HTML content in WebKit. This flaw allows a remote attacker to trick the victim into opening a specially crafted web page, triggering a heap buffer overflow error and leading to the execution of arbitrary code on the system.


Remediation:
Intel: Out-of-bounds read in firmware for Integrated Sensor Solution
CVE: CVE-2022-30339
Component: hw
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

An out-of-bounds read flaw was found in hw. The firmware for the Intel(R) Integrated Sensor Solution may allow a privileged user to enable a denial of service via local access.


Remediation:
Please contact the hardware vendor for more updates.
Use-after-free leading to arbitrary code execution
CVE: CVE-2022-26717
Component: webkitgtk
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-05-17T00:00:00+00:00

A flaw was found in webkitgtk. Due to improper input validation, the issue occurs, leading to a use-after-free vulnerability. This flaw allows an attacker with network access to pass specially crafted web content files, causing an application to halt, crash, or arbitrary code execution.


Remediation: