huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-43813: grafana: directory traversal vulnerability
Component: grafana
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-12-10T00:00:00+00:00

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.


Affected upstream versions: >= 5.0.0, < 7.5.12, >= 8.0.0, < 8.3.2
Upstream repository: https://github.com/github/securitylab-vulnerabilities
Upstream fix commit: 689fc5d9fd665be4d5bba200a6a433b532172d0f
CVE-2021-43818: python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through
Component: python-lxml
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L)
Public date: 2021-12-12T00:00:00+00:00

There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's HTML Cleaner may be able to trigger script execution in clients such as web browsers. This can occur because the HTML Cleaner did not remove scripts within SVG images in data URLs such as <img src="">. XSS can result in impacts to the integrity and availability of the web page, as well as a potential impact to data confidentiality in some circumstances.

Statement: This flaw is rated as Moderate because code execution is limited to the web browser scope.

Following products ship affected component, however the vulnerability is not exposed in the product code. Therefore, we are reducing their impact to moderate.
* Red Hat Satellite 6.10
* Red Hat Update Infrastructure for Cloud Providers 4

Affected upstream versions: < 4.6.5
Fixed upstream versions: lxml-4.6.5
Upstream repository: https://github.com/lxml/lxml
Upstream fix commit: 12fa9669007180a7bb87d990c375cf91ca5b664a
CVE-2021-43824: envoy: Null pointer dereference when using JWT filter safe_regex match
Component: envoy
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-22T07:00:00+00:00

A flaw was found in envoy. A crafted request can potentially trigger a NULL pointer dereference when using a WT filter safe_regex match.


Affected upstream versions: >= 1.20.0, < 1.20.2, >= 1.19.0, < 1.19.3, < 1.18.6, >= 1.21.0, < 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 9371333230b1a6e1be2eccf4868771e11af6253a
CVE-2021-43825: envoy: Use-after-free when response filters increase response data
Component: envoy
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-22T07:00:00+00:00

A flaw was found in envoy. If the amount of buffered data by envoy goes over the limit, the buffer may overflow while a response is being processed by the filter chain. This issue possibly causes the operation to abort incorrectly, resulting in the access of a freed memory block.


Affected upstream versions: < 1.18.6, >= 1.19.0, < 1.19.3, >= 1.20.0, < 1.20.2, >= 1.21.0, < 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 148de954ed3585d8b4298b424aa24916d0de6136
CVE-2021-43826: envoy: Use-after-free when tunneling TCP over HTTP
Component: envoy
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-22T07:00:00+00:00

A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service.


Affected upstream versions: < 1.18.6, >= 1.19.0, < 1.19.3, >= 1.20.0, < 1.20.2, >= 1.21.0, < 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: ce0ae309057a216aba031aff81c445c90c6ef145
CVE-2021-43859: xstream: Injecting highly recursive collections or maps can cause a DoS
Component: xstream
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-01-29T00:00:00+00:00

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 7, hence, marked as Out-of-Support-Scope. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: < 1.4.19
Fixed upstream versions: XSTREAM_1_4_19
Upstream repository: https://github.com/x-stream/xstream
Upstream fix commit: e8e88621ba1c85ac3b8620337dd672e0c0c3a846
CVE-2021-43860: flatpak: Permissions granted to applications can be hidden from the user at install time
Component: flatpak
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
Public date: 2022-01-12T00:00:00+00:00

An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime in the case that there's a null byte in the metadata file of an app. This issue allows apps to grant themselves permissions without the user's consent.


Affected upstream versions: >= 1.11.0, < 1.12.3, < 1.10.6
Fixed upstream versions: 1.13.1
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 54ec1a482dfc668127eaae57f135e6a8e0bc52da
CVE-2021-43975: kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-11-15T00:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel’s Aquantia AQtion Ethernet card Atlantic driver in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to emulate the networking device and crash the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Upstream fix commit: b922f622592af76b57cbc566eaeccda0b31a3496
CVE-2021-43976: kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 4.6 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-10-31T00:00:00+00:00

A denial of service flaw was found in mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c in the usb subsystem of the Linux kernel. This is due to a missing clean-up for a malfunctioning usb device with an unknown recv_type.


Affected upstream versions: n/a
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 04d80663f67ccef893061b49ec8a42ff7045ae84
CVE-2021-44225: keepalived: dbus access control bypass
Component: keepalived
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-11-26T00:00:00+00:00

A flaw was found in keepalived, where an improper authentication vulnerability allows an unprivileged user to change properties that could lead to an access-control bypass.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.5
Upstream repository: https://github.com/acassen/keepalived
Upstream fix commit: 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d
CVE-2021-4442: kernel: tcp: add sanity tests to TCP_QUEUE_SEQ
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tcp: add sanity tests to TCP_QUEUE_SEQ

Qingyu Li reported a syzkaller bug where the repro
changes RCV SEQ _after_ restoring data in the receive queue.

mprotect(0x4aa000, 12288, PROT_READ)    = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0
connect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0
setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [1], 4) = 0
sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="0x0000000000000003\0\0", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
setsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0
setsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0
recvfrom(3, NULL, 20, 0, NULL, NULL)    = -1 ECONNRESET (Connection reset by peer)

syslog shows:
[  111.205099] TCP recvmsg seq # bug 2: copied 80, seq 0, rcvnxt 80, fl 0
[  111.207894] WARNING: CPU: 1 PID: 356 at net/ipv4/tcp.c:2343 tcp_recvmsg_locked+0x90e/0x29a0

This should not be allowed. TCP_QUEUE_SEQ should only be used
when queues are empty.

This patch fixes this case, and the tx path as well.

Statement: This issue is fixed in RHEL-8.5 and above
~~~
in (rhel-8.5, rhel-8.6, rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) tcp: add sanity tests to TCP_QUEUE_SEQ
~~~

Affected upstream versions: 3.5
Fixed upstream versions: 0, 4.19.181, 5.10.24, 5.11.7, 5.12, 5.4.106
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 319f460237fc2965a80aa9a055044e1da7b3692a
CVE-2021-4460: kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
Component: kernel
Severity: Moderate
CWE: CWE-1335 (Incorrect Bitwise Shift of Integer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the Linux kernel’s AMD Kernel Fusion Driver (amdkfd) within the drm subsystem. When either get_num_sdma_queues() or get_num_xgmi_sdma_queues() returned 0, the driver performed a bit shift where the number of bits shifted equaled the operand width. Such a shift is undefined behavior in C and can lead to incorrect values being used in subsequent logic.A local user with the ability to exercise the affected kernel APIs could trigger unintended behavior in the DRM/AMD GPU driver, which may result in a kernel crash and impact system availability


Affected upstream versions: 3.19
Fixed upstream versions: 0, 5.10.36, 5.11.20, 5.12.3, 5.13, 5.4.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0c0356ef2498c1a250fe3846f30293f828737309
CVE-2021-44733: kernel: use-after-free in the TEE subsystem
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-12-14T12:00:00+00:00

A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can trigger this issue.


Affected upstream versions: n/a
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: dfd0743f1d9ea76931510ed150334d571fbab49d
CVE-2021-45463: gegl: shell expansion via a crafted pathname
Component: gegl
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-12-15T00:00:00+00:00

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity.


Affected upstream versions: n/a
Fixed upstream versions: GEGL_0_4_34
Upstream repository: https://gitlab.gnome.org/GNOME/gegl
Upstream fix commit: bfce470f0f2f37968862129d5038b35429f2909b
CVE-2021-45485: kernel: information leak in the IPv6 implementation
Component: kernel
Severity: Moderate
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-05-31T00:00:00+00:00

An information leak flaw was found in the Linux kernel’s IPv6 implementation in the __ipv6_select_ident in net/ipv6/output_core.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information.


Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 62f20e068ccc50d6ab66fdb72ba90da2b9418c99
CVE-2021-45486: kernel: information leak in the IPv4 implementation
Component: kernel
Severity: Moderate
CWE: CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)
CVSS v3: 3.5 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-03-24T00:00:00+00:00

An information leak flaw was found in the Linux kernel’s IPv4 implementation in the ip_rt_init in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information.


Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c
Upstream fix commit: aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba
CVE-2021-45930: qt: out-of-bounds write may lead to DoS
Component: qt
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-12-31T00:00:00+00:00

A flaw was found in qtsvg's qsvghandler.cpp module. An attacker who is able to submit a crafted image file to an application that uses qsvghandler could cause an out-of-bounds write and potential denial of service to occur, depending on the application.

Statement: This flaw is out of support scope for versions of qt shipped with Red Hat Enterprise Linux 6 and 7 as it does not affect qt3, which does not have the qsvghandler.

Affected upstream versions: n/a
Fixed upstream versions: v5.12.12
Upstream repository: https://github.com/qt/qtsvg
Upstream fix commit: a3b753c2d077313fc9eb93af547051b956e383fc
CVE-2021-46784: squid: DoS when processing gopher server responses
Component: squid
Severity: Important
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-06-23T00:00:00+00:00

A vulnerability was found in squid (Web proxy cache server). This issue occurs due to improper buffer management while processing Gopher server responses. This flaw leads to a remote denial of service or a crash if it receives specially crafted network traffic, either by mistake or a malicious actor.


Affected upstream versions: n/a
Fixed upstream versions: SQUID_6_0_1
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: 5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9
CVE-2021-46822: libjpeg-turbo: heap buffer overflow in get_word_rgb_row() in rdppm.c
Component: libjpeg-turbo
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-04-07T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in libjpeg-turbo in the get_word_rgb_row() function in rdppm.c. The flaw occurs when the PPM reader in libjpeg-turbo mishandles use of the tjLoadImage() function for loading a 16-bit binary PPM file into a grayscale uncompressed image buffer and then loading a 16-bit binary PGM file into an RGB uncompressed image buffer. This flaw allows a remote attacker to persuade a victim to open a specially-crafted file, causing the application to crash.

Statement: The only way that users could potentially encounter these issues is through the tjLoadImage() function. TJBench and cjpeg are unaffected.

RHEL-8 ships libjpeg-turbo v1.5.3 which does not include vulnerable tjLoadImage() functionality.

Affected upstream versions: n/a
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Upstream fix commit: f35fd27ec641c42d6b115bfa595e483ec58188d2
CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections
Component: libtirpc
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-20T00:00:00+00:00

A denial of service (DoS) vulnerability was found in libtirpc. This flaw allows a remote attacker to exhaust the file descriptors of a process that uses libtirpc due to mishandling idle TCP connections. This issue leads to a svc_run infinite loop without accepting new connections.


Affected upstream versions: n/a
Upstream repository: https://git.linux-nfs.org/steved/libtirpc.git
Upstream fix commit: 86529758570cef4c73fb9b9c4104fdc510f701ed
CVE-2021-46829: gdk-pixbuf: heap-based buffer overflow when compositing or clearing frames in GIF files
Component: gdk-pixbuf
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-07-24T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in GNOME GdkPixbuf (aka GDK-PixBuf) when compositing or clearing frames in GIF files. The vulnerability exists due to a boundary error when processing GIF images. This flaw allows an attacker to create a specially crafted GIF image, trick the victim into opening it, triggering an out-of-bounds write, which allows executing arbitrary code on the target system or causing a potential crash.

Statement: Red Hat Enterprise Linux - 6, 7, and 8 are not affected because there is no presence of vulnerable function/code in our code-base.

Affected upstream versions: n/a
Fixed upstream versions: 2.42.8
Upstream repository: https://gitlab.gnome.org/GNOME/gdk-pixbuf
Upstream fix commit: bca00032ad68d0b0aa2c1f7558db931e52bd9cd2
CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OK
Component: libtasn1
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-24T00:00:00+00:00

An out-of-bounds read flaw was found in Libtasn1 due to an ETYPE_OK off-by-one error in the asn1_encode_simple_der() function. This flaw allows a remote attacker to pass specially crafted data or invalid values to the application, triggering an off-by-one error, corrupting the memory, and possibly performing a denial of service (DoS) attack.

Statement: This flaw enables access to one additional memory byte, significantly constraining the potential damage an attacker could inflict. For this reason it is rated as having a Moderate impact to Red Hat Offerings.

Affected upstream versions: n/a
Fixed upstream versions: v4.19.0
Upstream repository: https://gitlab.com/gnutls/libtasn1
Upstream fix commit: 44a700d2051a666235748970c2df047ff207aeb5
CVE-2021-46905: kernel: NULL-deref on disconnect regression
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-26T00:00:00+00:00

A vulnerability was found in the Linux kernel. This flaw occurs due to an unconditional NULL-pointer dereference on every disconnect in the Linux kernel.


Affected upstream versions: 4.19.187 < 4.19.189, 5.4.112 < 5.4.115, 5.10.30 < 5.10.33, 5.11.14 < 5.11.17, 5.12
Fixed upstream versions: 0, 4.19.189, 5.10.33, 5.11.17, 5.12.1, 5.13, 5.4.115
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5871761c5f0f20d6e98bf3b6bd7486d857589554
CVE-2021-46909: kernel: PCI interrupt mapping cause oops
Component: kernel
Severity: Low
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-27T00:00:00+00:00

A denial of service flaw was found in the ARM footbridge in the Linux Kernel. This issue may cause an oops if a PCI driver is loaded or bound after the kernel has initialized.

Statement: This vulnerability only affects unusual configurations of specific CPUs and affects the availability of only some system hardware. For those reasons, Red Hat considers the impact of this vulnerability to be Low.

Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.232, 4.19.189, 5.10.32, 5.11.16, 5.12, 5.4.114
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf
CVE-2021-46915: kernel: netfilter: divide error in nft_limit_init
Component: kernel
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-27T00:00:00+00:00

A denial of service flaw was found in nft_limit_init in netfilter's nft_limit in the Linux Kernel. This issue occurs due to an inappropriate math function selection, which may cause an availability threat.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.232, 4.19.189, 5.10.32, 5.11.16, 5.12, 5.4.114
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9065ccb9ec92c5120e7e97958397ebdb454f23d6