huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-54313: kernel: Linux kernel OverlayFS: Kernel crash via null pointer dereference in ovl_get_acl_rcu()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the OverlayFS (ovl) component of the Linux kernel. A local user can trigger a null pointer dereference by performing a specific sequence of file system operations. This vulnerability occurs when the ovl_get_acl_rcu() function attempts to access a real inode that has been set to NULL due to a race condition during inode destruction. Successful exploitation leads to a kernel crash, causing a Denial of Service (DoS).


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.121, 6.1.40, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d97481c7b2739a704848bb3c01f224dc71bdf78e
CVE-2023-54316: kernel: refscale: Fix uninitalized use of wait_queue_head_t
Component: kernel
Severity: Low
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A use of uninitialized data was found in the refscale test module. The wait_queue_head_t is used before being initialized, causing a race condition that can crash the kernel during testing.

Statement: This affects only the refscale test/benchmark module, which is not loaded in production systems. The crash is a race condition in test initialization code used for RCU performance analysis.

Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 066fbd8bc981cf49923bf828b7b4092894df577f
CVE-2023-54317: kernel: dm flakey: don't corrupt the zero page
Component: kernel
Severity: Moderate
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's dm-flakey device mapper target. When the corrupt bio writes option is enabled, dm-flakey can corrupt the kernel's global zero page. Since the zero page is shared system-wide and used by glibc's calloc() implementation via mmap, corrupting it causes userspace programs to receive non-zeroed memory from calloc(), leading to widespread application crashes and unpredictable behavior.

Statement: The dm-flakey target is a testing and debugging tool designed to simulate unreliable storage devices. While corrupting the zero page has severe system-wide consequences, dm-flakey requires root privileges to configure and is not typically used in production environments. The impact is limited to systems actively using dm-flakey with corrupt bio writes enabled.

Affected upstream versions: 4.14.158 < 4.14.308, 4.19.88 < 4.19.276, 4.9.206 < 4.10, 5.0
Fixed upstream versions: 0, 4.10, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b7f8892f672222dbfcc721f51edc03963212b249
CVE-2023-54318: kernel: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was found in the SMC networking subsystem. Iterating over the link group list in smcr_port_add() without holding the lock can cause crashes when concurrent add/remove operations modify the list.

Statement: This affects systems using SMC over RDMA networking. The race requires concurrent InfiniBand port events and link group management, typically occurring in high-availability configurations with dynamic port state changes.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d1c6c93c27a4bf48006ab16cd9b38d85559d7645
CVE-2023-54320: kernel: platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak was found in the AMD PMC driver's STB debugfs interface. When amd_pmc_send_cmd() fails, the allocated buffer is not freed, causing memory to leak on each failed operation.

Statement: This affects AMD systems with STB (Smart Trace Buffer) debugging enabled. The leak occurs only when PMC command failures happen while reading debugfs, which is uncommon in normal operation.

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d804adef7b23b22bb82e1b3dd113e9073cea9bc1
CVE-2023-54321: kernel: driver core: fix potential null-ptr-deref in device_add()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in the driver core's device_add() function. When dpm_sysfs_add() fails after bus_add_device() succeeds, the error path attempts to remove the driver binding that was never completed, causing a crash.

Statement: This crash requires device registration to fail at a specific point, typically due to sysfs errors or resource exhaustion. The affected code path is in core driver infrastructure but requires unusual failure conditions.

Affected upstream versions: 2.6.26
Fixed upstream versions: 0, 5.10.249, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 97aa8fb74bbe9aaf4ed5962a784f73b071bd16bf
CVE-2023-54322: kernel: arm64: set __exception_irq_entry with __irq_entry as a default
Component: kernel
Severity: Low
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A stack trace handling issue was found in ARM64 kernels. Without CONFIG_FUNCTION_GRAPH_TRACER, the IRQ entry function is not properly marked, causing filter_irq_stacks() to fail and potentially causing stack depot overflow warnings under KASAN.

Statement: This primarily affects ARM64 systems running KASAN with heavy interrupt load. The issue causes stack traces to be unnecessarily long, potentially filling the stack depot. Normal operation without KASAN is unaffected.

Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.10.188, 5.15.150, 6.1.175, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c71d6934c6ac40a97146a410e0320768c7b1bb3c
CVE-2023-54323: kernel: cxl/pmem: Fix nvdimm registration races
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was found in the CXL persistent memory driver. Rapid module load/unload cycles can cause async nvdimm device registration to run after the CXL context has been torn down, resulting in a NULL pointer dereference.

Statement: This affects CXL-capable systems with persistent memory. Triggering requires rapid module insertion/removal cycles, which is not typical in production but can occur during testing or development.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a371788d4f4a7f59eecd22644331d599979fd283
CVE-2023-54324: kernel: dm: fix a race condition in retrieve_deps
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's device-mapper multipath implementation. A race condition exists between retrieve_deps() and multipath_message() when devices are added or removed. The retrieve_deps() function walks the device list without holding a lock while multipath_message() can modify the list, leading to use-after-free or memory corruption.

Statement: This affects systems using device-mapper multipath. The race requires concurrent multipath configuration changes while querying device dependencies. The use-after-free could potentially lead to kernel crashes or memory corruption, though exploitation for privilege escalation would be difficult.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 6.1.56, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dbf1a719850577bb51fc7512a3972994b797a17b
CVE-2023-54325: kernel: crypto: qat - fix out-of-bounds read
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

An out-of-bounds read vulnerability was found in the Linux kernel's Intel QAT (QuickAssist Technology) crypto driver. When preparing an AES-CTR encryption request on QAT GEN4 devices, the driver rounds up the key size by 16 bytes before copying. If this rounding occurs before the memcpy operation, the driver reads beyond the bounds of the user-provided key buffer.

Statement: This flaw affects systems with Intel QAT GEN4 hardware accelerators using the crypto API. The out-of-bounds read occurs during cipher key setup and could potentially leak kernel memory contents or cause a crash. Exploitation requires local access and the ability to configure cryptographic operations on QAT devices.

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7697139d5dfd491f4c495a914a1dd68f6e827a0f
CVE-2023-54326: kernel: misc: pci_endpoint_test: Free IRQs before removing the device
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's PCI endpoint test driver. In pci_endpoint_test_remove(), IRQs are freed after the device is removed, creating a race window where an IRQ can be delivered after device memory is freed. The IRQ handler then accesses invalid memory, causing a kernel crash.

Statement: This affects systems using the PCI endpoint test driver for PCIe endpoint testing. The race occurs during device hot-unplug or driver removal. Production systems typically do not use this test driver, limiting real-world exposure.

Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fb7f8bdb886f2ebf35ee5edaf2bf5f02b063ddb7
CVE-2023-5678: openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow
Component: openssl
Severity: Low
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-10-24T00:00:00+00:00

A flaw was found in OpenSSL, which caused the generation or checking of long X9.42 DH keys or parameters to be much slower than expected. This issue could lead to a denial of service.

Statement: This vulnerability in OpenSSL is categorized as a low severity issue primarily because it requires specific conditions to exploit and doesn't directly result in a full Denial of Service (DoS). While the excessive time spent in DH key generation or verification could potentially cause delays, the impact is mitigated by the fact that it requires untrusted sources supplying large Q parameter values. Additionally, the OpenSSL SSL/TLS implementation remains unaffected, limiting the scope of potential attacks. Moreover, there are inherent limits on key length, which further restrict the potential for exploitation.

Affected upstream versions: 1.0.2 < 1.0.2zj, 1.1.1 < 1.1.1x, 3.0.0 < 3.0.13, 3.1.0 < 3.1.5
Fixed upstream versions: 1.0.2zj, 1.1.1x, 3.0.13, 3.1.5
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 34efaef6c103d636ab507a0cc34dca4d3aecc055
CVE-2023-5717: kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-10-25T00:00:00+00:00

A flaw was found in the Linux kernel's Performance Events system component. A condition can be triggered that allows data to be written past the end or before the beginning of the intended memory buffer. This issue may lead to a system crash, code execution, or local privilege escalation.


Affected upstream versions: 4.4 < 6.6
Fixed upstream versions: 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/events
Upstream fix commit: 32671e3799ca2e4590773fd0e63aaa4229e50c06
CVE-2023-6110: openstack: deleting a non existing access rule deletes another existing access rule in it's scope
Component: openstack
Severity: Moderate
CWE: CWE-237 (Improper Handling of Structural Elements)
CVSS v3: 5.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-01-24T00:00:00+00:00

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.


Fixed upstream versions: 0:5.5.2-17.1.20230829210830.el9ost, 0:5.5.2-17.1.20230829213816.el8ost
Upstream repository: https://code.engineering.redhat.com/gerrit/python-openstackclient.git
Upstream fix commit: 7a7c364bdd7b2cd2b56e73724110710a68d58abf
CVE-2023-6129: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC
Component: openssl
Severity: Low
CWE: CWE-328 (Use of Weak Hash)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-01-09T00:00:00+00:00

A flaw was found in in the POLY1305 MAC (message authentication code) implementation in OpenSSL, affecting applications running on PowerPC CPU-based platforms that utilize vector instructions, and has the potential to corrupt the internal state of these applications. If an attacker can manipulate the utilization of the POLY1305 MAC algorithm, it may lead to the corruption of the application state, resulting in various application-dependent consequences, often resulting in a crash and leading to a denial of service.

Statement: This vulnerability is categorized as having a Low severity due to the limited scope of its potential impact and the specific conditions required for exploitation. The vulnerability arises in the POLY1305 MAC implementation within OpenSSL on PowerPC CPUs, affecting newer processors supporting PowerISA 2.07 instructions. The issue involves the restoration of vector registers in a different order than they are saved, potentially corrupting application state upon return to the caller. The impact varies, contingent on the application's reliance on non-volatile XMM registers, ranging from incorrect calculations to potential denial of service. However, the practical exploitation of this vulnerability requires an attacker to influence the use of the POLY1305 MAC algorithm. Given the specific conditions needed for exploitation and the absence of concrete instances of affected applications, the overall risk is assessed as low. Additionally, the severity is tempered by the assumption that the most likely outcome is limited to incorrect results in application-dependent calculations or crashes, rather than enabling a full compromise of the application process.

Affected upstream versions: 3.2.0 < 3.2.1, 3.1.0 < 3.1.5, 3.0.0 < 3.0.13
Fixed upstream versions: 3.0.13, 3.1.5, 3.2.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 5b139f95c9a47a55a0c54100f3837b1eee942b04
CVE-2023-6176: kernel: local dos vulnerability in scatterwalk_copychunks
Component: kernel
Severity: Low
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-12T00:00:00+00:00

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system.


Affected upstream versions: <= v6.5
Fixed upstream versions: 0:4.18.0-553.el8_10, 0:4.18.0-553.rt7.342.el8_10, 0:5.14.0-427.13.1.el9_4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cfaa80c91f6f99b9342b6557f0f0e1143e434066
CVE-2023-6237: openssl: Excessive time spent checking invalid RSA public keys
Component: openssl
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-15T00:00:00+00:00

A flaw was found in OpenSSL. When the EVP_PKEY_public_check() function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large prime, this computation takes a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the upstream OpenSSL security team.

The marked moderate issue in OpenSSL involves a flaw in the EVP_PKEY_public_check() function used for RSA public keys. When verifying keys, the computation to confirm the composite nature of the RSA modulus may take an extended time if the modulus is a large prime. This vulnerability could be exploited for a Denial of Service attack in applications using this function with RSA keys from untrusted sources. The severity is moderate as it requires specific conditions for exploitation and may not pose an immediate widespread threat.

Affected upstream versions: 3.0.0 < 3.0.13, 3.1.0 < 3.1.5, 3.2.0 < 3.2.1
Fixed upstream versions: 3.0.13, 3.1.5, 3.2.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 18c02492138d1eb8b6548cb26e7b625fb2414a2a
CVE-2023-6377: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
Component: xorg-x11-server
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-12-13T00:00:00+00:00

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.14, 0:1.11.0-22.el9_0.5, 0:1.11.0-8.el8_4.5, 0:1.12.0-14.el9_2.2, 0:1.12.0-15.el8_8.4, 0:1.12.0-6.el8_6.6, 0:1.13.1-2.el8_9.4, 0:1.13.1-3.el9_3.3, 0:1.20.11-22.el8, 0:1.20.11-24.el9, 0:1.20.4-25.el7_9, 0:1.8.0-28.el7_9, 0:1.9.0-15.el8_2.6, 0:21.1.3-15.el8, 0:22.1.9-5.el9
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 0c1a93d319558fe3ab2d94f51d174b4f93810afd
CVE-2023-6478: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
Component: xorg-x11-server
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)
Public date: 2023-12-13T00:00:00+00:00

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.13, 0:1.11.0-22.el9_0.5, 0:1.11.0-8.el8_4.5, 0:1.12.0-14.el9_2.2, 0:1.12.0-15.el8_8.4, 0:1.12.0-6.el8_6.6, 0:1.13.1-2.el8_9.4, 0:1.13.1-3.el9_3.3, 0:1.20.11-22.el8, 0:1.20.11-24.el9, 0:1.20.4-25.el7_9, 0:1.8.0-28.el7_9, 0:1.9.0-15.el8_2.6, 0:21.1.3-15.el8, 0:22.1.9-5.el9
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 14f480010a93ff962fef66a16412fafff81ad632
CVE-2023-6546: kernel: GSM multiplexing race condition leads to privilege escalation
Component: kernel
Severity: Important
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-12-21T00:00:00+00:00

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.

Statement: This vulnerability is critical because it can be exploited to escalate privileges, directly threatening system security. Despite requiring local access and having a high attack complexity, the potential to severely impact confidentiality, integrity, and availability justifies its "Important" rating.

Affected upstream versions: <= v6.4
Fixed upstream versions: 0:4.18.0-193.136.1.el8_2, 0:4.18.0-305.134.1.el8_4, 0:4.18.0-305.134.1.rt7.210.el8_4, 0:4.18.0-372.93.1.el8_6, 0:4.18.0-477.55.1.el8_8, 0:4.18.0-513.24.1.el8_9, 0:4.18.0-513.24.1.rt7.326.el8_9, 0:5.14.0-284.55.1.el9_2, 0:5.14.0-284.55.1.rt14.340.el9_2, 0:5.14.0-427.13.1.el9_4, 0:5.14.0-70.93.1.rt21.165.el9_0, 0:5.14.0-70.93.2.el9_0, v0.1.0-225, v0.1.0-527, v0.28.1-57, v0.4.0-248, v1.0.0-480, v1.1.0-228, v1.14.6-215, v2.9.6-15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3c4f8333b582487a2d1e02171f1465531cde53e3
CVE-2023-6597: python: Path traversal on tempfile.TemporaryDirectory
Component: python
Severity: Important
CWE: CWE-61 (UNIX Symbolic Link (Symlink) Following)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
Public date: 2024-03-19T00:00:00+00:00

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.9.0 < 3.9.19, 3.10.0 < 3.10.14, 3.11.0 < 3.11.8, 3.12.0 < 3.12.1, 3.13.0a1 < 3.13.0a3
Fixed upstream versions: v3.13.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 81c16cd94ec38d61aa478b9a452436dc3b1b524d