huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-26237: nodejs-highlight-js: prototype pollution via a crafted HTML code block
Component: nodejs-highlight-js
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N)
Public date: 2020-11-23T00:00:00+00:00

A flaw was found in nodejs-highlight-js. Highlight.js is vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.

Statement: In Red Hat Virtualization, ovirt-engine-api-explorer uses a vulnerable version of highlight.js, however since release 4.4.3 ovirt-engine-api-explorer is obsoleted and no longer used.

Affected upstream versions: < 9.18.2, >= 10.0.0, < 10.1.2
Fixed upstream versions: 10.1.2
Upstream repository: https://github.com/highlightjs/highlight.js
Upstream fix commit: 7241013ae011a585983e176ddc0489a7a52f6bb0
CVE-2020-26238: cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution
Component: cron-utils
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-11-24T00:00:00+00:00

A flaw was found in cron-utils. End applications passing unsanitized user input which is subsequently parsed by the `@Cron` annotation can allow an attacker to execute arbitrary expressions using JavaEL which will be implicitly executed by the constraint validator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: < 9.1.3
Fixed upstream versions: 9.1.3
Upstream repository: https://github.com/jmrozanec/cron-utils
Upstream fix commit: 4cf373f7352f5d95f0bf6512af8af326b31c835e
CVE-2020-26247: rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema
Component: rubygem-nokogiri
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2020-12-30T00:00:00+00:00

A flaw was found in Nokogiri. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XML External Entity (XXE) or Server-side request forgery (SSRF) attacks. The highest threat from this vulnerability is to data confidentiality.


Affected upstream versions: < 1.11.0.rc4
Fixed upstream versions: v1.11.0
Upstream repository: https://github.com/sparklemotion/nokogiri
Upstream fix commit: 9c87439d9afa14a365ff13e73adc809cb2c3d97b
CVE-2020-26289: nodejs-date-and-time: ReDoS in parsing via date.compile
Component: nodejs-date-and-time
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-12-24T00:00:00+00:00

A flaw was found in nodejs-date-and-time. In date-and-time there a regular expression involved in parsing which can be exploited to cause a denial of service.


Affected upstream versions: < 0.14.2
Fixed upstream versions: v0.14.2
Upstream repository: https://github.com/knowledgecode/date-and-time
Upstream fix commit: 9e4b501eacddccc8b1f559fb414f48472ee17c2a
CVE-2020-26291: urijs: Hostname spoofing via backslashes in URL
Component: urijs
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2020-12-31T00:00:00+00:00

A flaw was found in urijs. The hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.


Affected upstream versions: < 1.19.4
Fixed upstream versions: v1.19.4
Upstream repository: https://github.com/medialize/URI.js
Upstream fix commit: b02bf037c99ac9316b77ff8bfd840e90becf1155
CVE-2020-26301: nodejs-ssh2: Command injection by calling vulnerable method with untrusted input
Component: nodejs-ssh2
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
Public date: 2021-09-20T00:00:00+00:00

A flaw was found in nodejs-ssh2. An OS command injection attack on Windows allows an attacker to perform remote code execution and potentially execute arbitrary code. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: This issue affects ssh2 as shipped with all versions of Red Hat Openshift Container Storage and Red Hat Openshift Data Foundations. However, this flaw requires a Windows based attack, and therefore, the impact is adjusted accordingly to a moderate risk.

Affected upstream versions: < 1.4.0
Fixed upstream versions: v1.0.0
Upstream repository: https://github.com/mscdex/ssh2
Upstream fix commit: f763271f41320e71d5cbee02ea5bc6a2ded3ca21
CVE-2020-26558: bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an impersonation attack
Component: bluez
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 4.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2021-05-24T16:00:00+00:00

A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP), Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the initiating device without any previous knowledge.

Statement: Red Hat Product Security is aware of this issue and is currently assessing the impact on Red Hat supported products. Corresponding entry in the Red Hat CVE database (https://access.redhat.com/security/security-updates/#/cve) will be updated with latest information as the assessment progresses.

Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6d19628f539fccf899298ff02ee4c73e4bf6df3f
CVE-2020-26570: opensc: heap-based buffer overflow in sc_oberthur_read_file
Component: opensc
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-10-06T00:00:00+00:00

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.


Affected upstream versions: n/a
Fixed upstream versions: 0.21.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 6903aebfddc466d966c7b865fae34572bf3ed23e
CVE-2020-26572: opensc: stack-based buffer overflow in tcos_decipher
Component: opensc
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-10-06T00:00:00+00:00

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.


Affected upstream versions: n/a
Fixed upstream versions: 0.21.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 9d294de90d1cc66956389856e60b6944b27b4817
CVE-2020-27152: Kernel: KVM: host stack overflow due to lazy update IOAPIC
Component: Kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2020-08-02T00:00:00+00:00

A stack overflow flaw via an infinite loop condition issue was found in the KVM hypervisor of the Linux kernel. This flaw occurs while processing interrupts because the IRQ state is erroneously set. This flaw allows a guest user to crash the host kernel, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 8. Future kernel updates for Red Hat Enterprise Linux 8  may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 77377064c3a94911339f13ce113b3abf265e06da
CVE-2020-27153: bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE
Component: bluez
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H)
Public date: 2020-09-06T00:00:00+00:00

In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.


Affected upstream versions: n/a
Fixed upstream versions: 5.55
Upstream repository: https://github.com/bluez/bluez
Upstream fix commit: 5a180f2ec9edfacafd95e5fed20d36fe8e077f07
CVE-2020-27170: kernel: Speculation on pointer arithmetic against bpf_context pointer
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-03-19T00:00:00+00:00

A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN.   A local user with the ability to insert eBPF instructions can use the eBPF verifier to abuse a spectre like flaw where they can infer all system memory.


Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f232326f6966cf2a1d1db7bc917a4ce5f9f55f76
CVE-2020-27223: jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS
Component: jetty
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-02-26T00:00:00+00:00

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Statement: In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of jetty.
Since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.
This may be fixed in the future.

[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated

Affected upstream versions: 9.4.6.v20170531 < unspecified, unspecified <= 9.4.36.v20210114, 10.0.0, 11.0.0
Fixed upstream versions: unspecified
Upstream repository: https://github.com/jetty/jetty.project
Upstream fix commit: 10e531756b972162eed402c44d0244f7f6b85131
CVE-2020-27619: python: Unsafe use of eval() on data retrieved via HTTP in the test suite
Component: python
Severity: Moderate
CWE: CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-10-05T00:00:00+00:00

In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Statement: As of Red Hat Quay 3.4 the python runtime will be consumed from RHEL. Currently releases up to 3.3 won't get fixes for this moderate issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.10.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 2ef5caa58febc8968e670e39e3d37cf8eef3cab8
CVE-2020-27777: kernel: powerpc: RTAS calls can be used to compromise kernel integrity
Component: kernel
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-10-08T00:00:00+00:00

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot)  guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

Statement: This issue is rated as having Moderate impact due to the required privileges and hardware dependencies.

Affected upstream versions: kernel 5.10-rc1
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
Upstream fix commit: bd59380c5ba4147dcbaad3e582b55ccfd120b764
CVE-2020-27786: kernel: use-after-free in kernel midi subsystem
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-12-02T02:00:00+00:00

A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: kernel 5.7-rc6
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d
CVE-2020-27792: ghostscript: heap buffer over write vulnerability in GhostScript's lp8000_print_page() in gdevlp8k.c
Component: ghostscript
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2019-11-06T00:00:00+00:00

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.


Affected upstream versions: <= ghostscript-9.02
Fixed upstream versions: 0:9.27-16.el8_10
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 4f6bc662909ab79e8fbe9822afb36e8a0eafc2b7
CVE-2020-27836: cluster-ingress-operator: changes to loadBalancerSourceRanges overwritten by operator
Component: cluster-ingress-operator
Severity: Important
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-12-10T00:00:00+00:00

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: Fixed in ose-cluster-ingress-operator-container-v4.6.0-202012161211.p0.
Upstream repository: https://github.com/openshift/cluster-ingress-operator
Upstream fix commit: 92c83f281ba5fb6a1d91ecc3beaa4bcf2647a729
CVE-2020-28196: krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS
Component: krb5
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-11-06T00:00:00+00:00

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.19-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 57415dda6cf04e73ffc3723be518eddfae599bfd
CVE-2020-28374: kernel: SCSI target (LIO) write to any block on ILO backstore
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-01-13T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on the backing store. The highest threat from this vulnerability is to integrity. In addition, this flaw affects the tcmu-runner package, where the affected SCSI command is called.


Affected upstream versions: n/a
Fixed upstream versions: v5.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4
CVE-2020-28458: datatables.net: prototype pollution if 'constructor' were used in a data property name
Component: datatables.net
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2020-10-25T00:00:00+00:00

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

Statement: OpenShift console container does package a vulnerable version of datatables.net, however as access to the vulnerable component is restricted via OpenShift OAuth the vulnerability is rated with an impact of `Low`.

Affected upstream versions: <= 1.10.22
Fixed upstream versions: unspecified
Upstream repository: https://github.com/DataTables/DataTablesSrc
Upstream fix commit: a51cbe99fd3d02aa5582f97d4af1615d11a1ea03
CVE-2020-28491: jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception
Component: jackson-dataformat-cbor
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-02-18T00:00:00+00:00

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Statement: In OpenShift Container Platform (OCP), the hive/presto/hadoop components that comprise the OCP metering stack, ship the vulnerable version of jackson-dataformat-cbor.
Since the release of OCP 4.6, the metering product has been deprecated [1], hence the affected components are marked as wontfix.
This may be fixed in the future.

In OCP 4.6 the openshift4/ose-logging-elasticsearch6 container delivers the vulnerable version of jackson-dataformat-cbor, but OCP 4.6 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities because it is now in the Maintenance Phase of the support, hence this component is marked as ooss. Since the release of OCP 4.7 this component is delivered as part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8 container).

[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated

Affected upstream versions: unspecified < 2.11.4, 2.12.0-rc1 < unspecified, unspecified < 2.12.1
Fixed upstream versions: 2.11.4, 2.12.1, unspecified
Upstream repository: https://github.com/FasterXML/jackson-dataformats-binary
Upstream fix commit: de072d314af8f5f269c8abec6930652af67bc8e6
CVE-2020-28896: mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection
Component: mutt
Severity: Moderate
CWE: CWE-319 (Cleartext Transmission of Sensitive Information)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2020-11-20T00:00:00+00:00

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

Statement: Red Hat Product Security has rated the severity of this flaw as Moderate because although the Confidentiality impact is high, the attack complexity is also high as a particular attacker would at least need to coordinate social engineering a victim to connect to a bad server, and also perform a man-in-the-middle attack or perform similar interception of the connection. Please see the following page for details on Red Hat severity ratings with special attention to Moderate: https://access.redhat.com/security/updates/classification .

Affected upstream versions: n/a
Fixed upstream versions: mutt-2-0-2-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: d92689088dfe80a290ec836e292376e2d9984f8f
CVE-2020-28915: kernel: out-of-bounds read in fbcon_get_font function
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.8 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H)
Public date: 2020-11-16T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in fbcon_get_font() in drivers/video/fbdev/core/fbcon.c in fbcon driver module in the Linux kernel. A bound check failure allows a local attacker with special user privilege to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to integrity and system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6735b4632def0640dbdf4eb9f99816aca18c4f16
CVE-2020-28974: kernel: slab-out-of-bounds read in fbcon
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2020-11-09T00:00:00+00:00

An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel's fbcon driver module. A bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds memory, leading to a system crash or leaking of internal kernel information. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3c4e0dff2095c579b142d5a0693257f1c58b4804
CVE-2020-29368: kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-06-03T00:00:00+00:00

An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check.

Statement: This flaw has been rated as having Moderateimpact because, based on Red Hat's assessment, this issue is hard to exploit in practice because the race window is too small for it to be reliable.

Affected upstream versions: n/a
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c444eb564fb16645c172d550359cb3d75fe8a040