huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-1393: xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
Component: xorg-x11-server
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-29T00:00:00+00:00

A vulnerability was found in X.Org Server. This flaw occurs if a client explicitly destroys the compositor overlay window (aka COW), where Xserver leaves a dangling pointer to that window in the CompScreen structure, which will later trigger a use-after-free issue. The Overlay Window use-after-free issue can lead to a local privilege escalation vulnerability.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9. Therefore, Red Hat Enterprise Linux 8 and 9 have been rated Moderate severity.

Affected upstream versions: xorg-server 21.1.8
Fixed upstream versions: xwayland-23.1.99.901
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 26ef545b3502f61ca722a7a3373507e88ef64110
CVE-2023-1428: gRPC: Reachable Assertion
Component: gRPC
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-09T00:00:00+00:00

A flaw was found in the gRPC library. Affected versions of this package are vulnerable to a reachable assertion, causing the abort function to be called and resulting in a denial of service.

Statement: This vulnerability is specific to the C++, Python and Ruby implementations of gRPC prior to the 1.53 release.
The gRPC library was packaged with Openshift via the Kuryr component. However, Kuryr was never configured to run code using the gRPC library and has since been removed.

Affected upstream versions: 1.51 < 1.53
Fixed upstream versions: 1.53
Upstream repository: https://github.com/grpc/grpc
Upstream fix commit: 2485fa94bd8a723e5c977d55a3ce10b301b437f8
CVE-2023-1476: kpatch: mm/mremap.c: incomplete fix for CVE-2022-41222
Component: kpatch
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-07T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available.

Affected upstream versions: <= v5.13
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 97113eb39fa7972722ff490b947d8af023e1f6a2
CVE-2023-1513: kernel: KVM: information leak in KVM_GET_DEBUGREGS ioctl on 32-bit systems
Component: kernel
Severity: Low
CWE: CWE-665 (Improper Initialization)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.

Statement: Red Hat Enterprise Linux 6 is not affected by this issue as KVM did not include the `KVM_GET_DEBUGREGS` ioctl.

Affected upstream versions: Fixed in kernel 6.2
Fixed upstream versions: v6.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2c10b61421a28e95a46ab489fd56c0f442ff6952
CVE-2023-1579: binutils: Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfd_getl64
Component: binutils
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-01-11T00:00:00+00:00

A heap based buffer overflow was found in binutils-gdb/bfd/libbfd.c in bfd_getl64 in binutils.

Statement: Because this vulnerability requires that an unsuspecting user uses binutils-gdb to analyze a specially crafted malicious DWARF file, and because the consequences of the memory corruption caused by the flaw are limited to the privileges of the user who analyzes the malicious file, Red Hat assesses this vulnerability's impact as Moderate.

Affected upstream versions: unknown
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 11d171f1910b508a81d21faa087ad1af573407d8
CVE-2023-1637: kernel: save/restore speculative MSRs during S3 suspend/resume
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-04-05T00:00:00+00:00

A flaw was found in the Linux kernel X86 CPU Power management when resuming CPU from suspend-to-RAM. This issue could allow a local user unauthorized access to memory from the CPU.


Affected upstream versions: Linux kernel 5.18-rc2
Fixed upstream versions: v5.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: e2a1256b17b16f9b9adf1b6fea56819e7b68e463
CVE-2023-1652: Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c
Component: Kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-12T06:30:00+00:00

A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.


Affected upstream versions: Kernel 6.2 RC5
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd
CVE-2023-1672: tang: Race condition exists in the key generation and rotation functionality
Component: tang
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-06-07T00:00:00+00:00

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.


Affected upstream versions: <= v13
Fixed upstream versions: v14
Upstream repository: https://github.com/latchset/tang
Upstream fix commit: 8dbbed10870378f1b2c3cf3df2ea7edca7617096
CVE-2023-1786: cloud-init: sensitive data could be exposed in logs
Component: cloud-init
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-04-27T00:00:00+00:00

A vulnerability was found in cloud-init. With this flaw, exposure of sensitive data is possible in world-readable cloud-init logs. This flaw allows an attacker to use this information to find hashed passwords and possibly escalate their privilege.


Affected upstream versions: <= 23.1
Fixed upstream versions: 23.1.2
Upstream repository: https://github.com/canonical/cloud-init
Upstream fix commit: a378b7e4f47375458651c0972e7cd813f6fe0a6b
CVE-2023-1829: kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-04-20T00:00:00+00:00

A use-after-free vulnerability was found in the traffic control index filter (tcindex) in the Linux kernel. The tcindex_delete does not properly deactivate filters, which can later lead to double freeing the structure. This flaw allows a local attacker to cause a use-after-free problem, leading to privilege escalation.

Statement: For Red Hat Enterprise Linux 7, please use the mitigation to disable module cls_tcindex, because similar use-after-free issues also exists in the Linux Kernel's traffic control index filter and will not be fixed before Red Hat Enterprise Linux 8.

Affected upstream versions: 3.8.0 < 4.14.308, 4.15.0 < 4.19.276, 4.20.0 < 5.4.235, 5.5.0 < 5.10.173, 5.11.0 < 5.15.100, 5.16.0 < 6.1.18, 6.2.0 < 6.2.5
Fixed upstream versions: 4.14.308, 4.19.276, 5.10.173, 5.15.100, 5.4.235, 6.1.18, 6.2.5, 6.3.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8c710f75256bb3cf05ac7b1672c82b92c43f3d28
CVE-2023-1855: kernel: use-after-free bug in remove function xgene_hwmon_remove
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-10T10:30:00+00:00

A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.

Statement: Because this flaw affects a specific CPU family, and because exploitation requires elevated system privileges, Red Hat assesses the impact of this flaw as Low.

Affected upstream versions: Linux kernel prior to Kernel 6.3 RC3
Fixed upstream versions: v6.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: cb090e64cf25602b9adaf32d5dfc9c8bec493cd1
CVE-2023-1989: kernel: Use after free bug in btsdio_remove due to race condition
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-09T06:30:00+00:00

A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.

Statement: Because successful exploitation of this flaw requires that a system supports SDIO hardware and that an attacker has control over attaching and detaching that hardware, Red Hat assesses the impact of this vulnerability as Moderate.

Affected upstream versions: Linux kernel version prior to Kernel 6.3 RC4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: f132c2d13088
CVE-2023-1998: kernel: Spectre v2 SMT mitigations problem
Component: kernel
Severity: Moderate
CWE: CWE-653 (Improper Isolation or Compartmentalization)
CVSS v3: 5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2023-04-12T00:00:00+00:00

It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes running on the same physical core in another hyperthread.


Affected upstream versions: <= v6.2
Fixed upstream versions: 6.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6921ed9049bc7457f66c1596c5b78aec0dae4a9d
CVE-2023-2008: kernel: udmabuf: improper validation of array index leading to local privilege escalation
Component: kernel
Severity: Important
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2023-04-13T00:00:00+00:00

A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

Statement: Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw as they did not include support for the userspace dmabuf misc driver (CONFIG_UDMABUF is not set).

Affected upstream versions: Fixed in kernel v5.19-rc4
Fixed upstream versions: v5.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 05b252cccb2e5c3f56119d25de684b4f810ba4
CVE-2023-20593: hw: amd: Cross-Process Information Leak
Component: hw
Severity: Moderate
CWE: CWE-1239 (Improper Zeroization of Hardware Register)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2023-07-25T06:30:00+00:00

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances.


Affected upstream versions: various, various, various, various, various, various, various, various
Fixed upstream versions: v6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 522b1d69219d8f083173819fde04f994aa051a98
CVE-2023-2124: kernel: OOB access in the Linux kernel's XFS subsystem
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-04-12T00:00:00+00:00

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: This vulnerability is rated as having a Moderate impact. While theoretically it could lead to privilege escalation, the only known impact is a denial of service.

Affected upstream versions: Linux kernel 6.4-rc1
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c
Upstream fix commit: 22ed903eee23a5b174e240f1cdfa9acf393a5210
CVE-2023-2163: kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe
Component: kernel
Severity: Important
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2023-04-19T00:00:00+00:00

An incorrect verifier pruning flaw was found in BPF in the Linux Kernel that may lead to unsafe code paths incorrectly marked as safe, resulting in arbitrary read/writes in kernel memory, lateral privilege escalation, and container escape.

Statement: The Red Hat Enterprise Linux 9.3 not affected, because the required patch applied before this CVE creation. For the Red Hat Enterprise Linux 9 before version 9.3 required fixes applied too.

Affected upstream versions: <= v6.2
Fixed upstream versions: 0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 71b547f561247897a0a14f3082730156c0533fed
CVE-2023-2166: kernel: NULL pointer dereference in can_rcv_filter
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-06T06:30:00+00:00

A NULL pointer dereference issue was found in the can protocol in net/can/af_can.c in the Linux kernel, where ml_priv may not be initialized in the receive path of CAN frames. This flaw allows a local user to crash the system or cause a denial of service.


Affected upstream versions: Linux Kernel version prior to Kernel 6.1 RC9
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0acc442309a0a1b01bcdaa135e56e6398a49439c
CVE-2023-2177: Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common
Component: Kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-25T12:30:00+00:00

A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/stream_sched.c in the Linux kernel. If stream_in allocation fails, stream_out is freed, which would be accessed further. This flaw allows a local user to crash the system or potentially cause a denial of service.


Affected upstream versions: Linux Kernel prior to Kernel 5.19 RC17
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Upstream fix commit: 181d8d2066c0
CVE-2023-2194: kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-16T00:00:00+00:00

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This issue could allow a local privileged user to crash the system or potentially achieve code execution.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this vulnerability as the shipped kernels did not include support for SLIMpro I2C device driver (upstream commit f6505fb). This flaw was rated Moderate as i2c devices are root-only accessible in RHEL.

Affected upstream versions: Fixed in kernel v6.3-rc4
Fixed upstream versions: v6.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 92fbb6d1296f
CVE-2023-2235: kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-15T00:00:00+00:00

The Linux kernel's Performance Events subsystem has a use-after-free flaw that occurs when a user triggers the perf_group_detach and remove_on_exec functions simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: The Red Hat Enterprise Linux 8.4 version is not affected by this flaw, as the vulnerable code was introduced in later versions of the Linux Kernel and was not backported to older releases.

Affected upstream versions: 5.13 < 6.3
Fixed upstream versions: 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fd0815f632c24878e325821943edccc7fde947a2
CVE-2023-22458: redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-17T00:00:00+00:00

A flaw was found in Redis, an in-memory database that persists on disk. This flaw allows authenticated users to issue an `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial of service by crashing Redis with an assertion failure.


Affected upstream versions: >= 6.2, < 6.2.9, >= 7.0, < 7.0.8
Fixed upstream versions: 7.2.0
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 16f408b1a0121cacd44cbf8aee275d69dc627f02
CVE-2023-22462: grafana: stored XSS vulnerability affecting the core plugin "Text"
Component: grafana
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)
Public date: 2023-03-02T00:00:00+00:00

A flaw was found in the Grafana core plugin, "Text." The vulnerability was possible due to React's render cycle that will pass through unsanitized HTML code. However, the HTML is cleaned and saved in Grafana's database in the next cycle. An attacker needs the Editor role in changing a Text panel to include JavaScript. Later, another user needs to edit the same Text panel and click "Markdown" or "HTML" to execute the code. This issue allows possible vertical privilege escalation, where a user with an Editor role can change to a known password for a user having an Admin role if the user with an Admin role executes malicious JavaScript viewing a dashboard.

Statement: OpenShift Service Mesh containers include the grafana RPM from RHEL and consume CVE fixes for grafana from RHEL channels. The servicemesh-grafana RPM shipped in early versions of OpenShift Service Mesh 2.1 is no longer maintained.

Affected upstream versions: >= 9.2, < 9.2.10, >= 9.3, < 9.3.4
Fixed upstream versions: v9.3.4
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: db83d5f398caffe35c5846cfa7727d1a2a414165
CVE-2023-22490: git: data exfiltration with maliciously crafted repository
Component: git
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2023-02-14T00:00:00+00:00

A vulnerability was found in Git. Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links (CVE-2022-39253), the objects directory may still be a symbolic link.


Affected upstream versions: >= 2.39.0, < 2.39.2, >= 2.38.0, < 2.38.4, >= 2.37.0, < 2.37.6, >= 2.36.0, < 2.36.5, >= 2.35.0, < 2.35.7, >= 2.34.0, < 2.34.7, >= 2.33.0, < 2.33.7, >= 2.32.0, < 2.32.6, >= 2.31.0, < 2.31.7, < 2.30.8
Fixed upstream versions: v2.40.0
Upstream repository: https://github.com/git/git
Upstream fix commit: c867e4fa180bec4750e9b54eb10f459030dbebfd
CVE-2023-22745: tpm2-tss: Buffer Overlow in TSS2_RC_Decode
Component: tpm2-tss
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-20T00:00:00+00:00

A flaw was found in tpm2-tss, which is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` index into the `layer_handler` with an 8-bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries. Trying to add a handler for higher-numbered layers or to decode a response code with a layer number, reads/writes past the end of the buffer. This buffer overrun could result in arbitrary code execution. An example attack is a man-in-the-middle (MiTM) bus attack that returns 0xFFFFFFFFFF for the RC. Given the common use case of TPM modules, an attacker must have local access to the target machine with local system privileges, which allows access to the TPM system. Usually, TPM access requires administrative privileges.


Affected upstream versions: < 4.0.1, < 3.2.2-rc0
Fixed upstream versions: 4.1.0
Upstream repository: https://github.com/tpm2-software/tpm2-tss
Upstream fix commit: 306490c8d848c367faa2d9df81f5e69dab46ffb5
CVE-2023-22998: kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init()
Component: kernel
Severity: Low
CWE: CWE-436 (Interpretation Conflict)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-28T00:00:00+00:00

In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as they did not include the `virtio_gpu_object_shmem_init` function, introduced upstream in commit 2f2aa13 ("drm/virtio: move virtio_gpu_mem_entry initialization to new function").

Affected upstream versions: n/a
Fixed upstream versions: v6.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c24968734abfed81c8f93dc5f44a7b7a9aecadfa