huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-28805: lua: heap buffer overread
Component: lua
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-08T00:00:00+00:00

A heap buffer-overflow vulnerability was found in Lua. The flaw occurs due to vulnerable code present in the lparser.c function of Lua that allows the execution of untrusted Lua code into a system, resulting in malicious activity.


Affected upstream versions: n/a
Fixed upstream versions: v5.4.5
Upstream repository: https://github.com/lua/lua
Upstream fix commit: 1f3c6f4534c6411313361697d98d1145a1f030fa
CVE-2022-28893: kernel: use after free in SUNRPC subsystem
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2022-04-11T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s net/sunrpc/xprt.c function in the Remote Procedure Call (SunRPC) protocol. This flaw allows a local attacker to crash the system, leading to a kernel information leak issue.


Affected upstream versions: n/a
Fixed upstream versions: v5.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1a3b1bba7c7a5eb8a11513cf88427cb9d77bc60a
CVE-2022-29162: runc: incorrect handling of inheritable capabilities
Component: runc
Severity: Low
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-05-13T00:00:00+00:00

A flaw was found in runc, where runc exec --cap executed processes with non-empty inheritable Linux process capabilities. This issue creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

Statement: This issue is rated as low severity as the vulnerability can only result in atypical linux environment,and it's  complex exploitation only results in minimal impact on system confidentiality, integrity, and availability in typical environments.

Affected upstream versions: < 1.1.2
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: d04de3a9b72d7a2455c1885fc75eb36d02cd17b5
CVE-2022-29173: go-tuf: No protection against rollback attacks for roles other than root
Component: go-tuf
Severity: Important
CWE: CWE-354 (Improper Validation of Integrity Check Value)
CVSS v3: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-05-06T00:00:00+00:00

A flaw was found in go-tuf. This flaw allows an attacker to cause clients to install older software than the software the client previously knew to be available and may include software with known vulnerabilities.


Affected upstream versions: < 0.3.0
Fixed upstream versions: v0.3.0
Upstream repository: https://github.com/theupdateframework/go-tuf
Upstream fix commit: ed6788e710fc3093a7ecc2d078bf734c0f200d8d
CVE-2022-29181: rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri
Component: rubygem-nokogiri
Severity: Important
CWE: CWE-241 (Improper Handling of Unexpected Data Type)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2022-05-19T00:00:00+00:00

A flaw was found in the rubygem-nokogiri package. This flaw allows malicious users to change partial contents or configurations on the system. Additionally, this vulnerability can also cause a limited denial of service in the form of interruptions in resource availability.

Statement: Red Hat Satellite 6.12 and later versions are not affected by this flaw.

Affected upstream versions: < 1.13.6
Fixed upstream versions: v1.13.6
Upstream repository: https://github.com/sparklemotion/nokogiri
Upstream fix commit: 83cc451c3f29df397caa890afc3b714eae6ab8f7
CVE-2022-29224: envoy: Segfault in GrpcHealthCheckerImpl
Component: envoy
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-06-09T14:00:00+00:00

A flaw was found in Envoy. This flaw allows an attacker who controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.) to crash Envoy by forcing the removal of the host from service discovery and then failing the gRPC health check request. This issue crashes Envoy via a NULL pointer dereference.


Affected upstream versions: < 1.22.1
Fixed upstream versions: v1.22.1
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 9b1c3962172a972bc0359398af6daa3790bb59db
CVE-2022-29225: envoy: Decompressors can be zip bombed
Component: envoy
Severity: Important
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-06-09T14:00:00+00:00

A flaw was found in Envoy. A specifically constructed HTTP body delivered by an untrusted downstream or upstream peer whose decompressed size is dramatically larger than the compressed size can be sent by an attacker to cause a denial of service.


Affected upstream versions: < 1.22.1
Fixed upstream versions: v1.22.1
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: cb4ef0b09200c720dfdb07e097092dd105450343
CVE-2022-29226: envoy: oauth filter allows trivial bypass
Component: envoy
Severity: Critical
CWE: CWE-303 (Incorrect Implementation of Authentication Algorithm)
CVSS v3: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
Public date: 2022-06-09T14:00:00+00:00

A flaw was found in Envoy. The OAuth filter does not include an implementation for validating access tokens, allowing remote attackers to bypass authentication to Envoy by providing any token value.


Affected upstream versions: < 1.22.1
Fixed upstream versions: v1.22.1
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 7ffda4e809dec74449ebc330cebb9d2f4ab61360
CVE-2022-29228: envoy: oauth filter calls continueDecoding() from within decodeHeaders()
Component: envoy
Severity: Important
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-06-09T14:00:00+00:00

A flaw was found in Envoy. The OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions.


Affected upstream versions: < 1.22.1
Fixed upstream versions: v1.22.1
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 7ffda4e809dec74449ebc330cebb9d2f4ab61360
CVE-2022-2938: kernel: use-after-free when psi trigger is destroyed while being polled
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-01-10T14:00:00+00:00

A flaw was found in the Linux kernel’s implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.

Statement: The Pressure Stall Subsystem (PSI) is disabled by default on Red Hat kernels, if the feature has not been explicitly enabled using a kernel boot time parameter of 'psi=1', the system is not affected.

Affected upstream versions: kernel 5.17
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a06247c6804f1a7c86a2e5398a4c1f1db1471848
CVE-2022-2953: libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-08-29T00:00:00+00:00

An out-of-bound read flaw was found in LibTIFF, in extractImageSection in the tools/tiffcrop.c:6905, allowing attackers to cause a denial of service via a crafted tiff file.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 48d6ece8389b01129e7d357f0985c8f938ce3da3
CVE-2022-29581: kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-15T00:00:00+00:00

A use-after-free flaw was found in u32_change in net/sched/cls_u32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information.

Statement: Keeping the impact Moderate, because only memory leak can happen by default, and both hard to reproduce (at least reproducer not exists yet).

Affected upstream versions: unspecified < 5.18, 4.14 < unspecified
Fixed upstream versions: 5.18, unspecified
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3db09e762dc79584a69c10d74a6b98f89a9979f8
CVE-2022-2959: kernel: watch queue race condition can lead to privilege escalation
Component: kernel
Severity: Important
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-27T00:00:00+00:00

A race condition was found in the Linux kernel's watch queue due to a missing lock in the pipe_resize_ring(). The race condition occurs when a thread uses ioctl(IOC_WATCH_QUEUE_SET_SIZE) to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl() to trigger a notification in the watch queue, calling post_one_notification() and accessing the freed pipe buffer. This flaw allows a local user to crash the system or escalate their privileges on the system.

Statement: Red Hat Enterprise Linux 6, 7 and 8 are not affected by this issue as they did not include support for general notification queue.

Affected upstream versions: Fixed in kernel 5.19
Fixed upstream versions: v5.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 189b0ddc245139af81198d1a3637cac74f96e13a
CVE-2022-29810: go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses
Component: go-getter
Severity: Moderate
CWE: CWE-532 (Insertion of Sensitive Information into Log File)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2022-04-27T00:00:00+00:00

A flaw was found in go-getter, where the go-getter library can write SSH credentials into its log file. This flaw allows a local user with access to read log files to read sensitive credentials, which may lead to privilege escalation or account takeover.


Affected upstream versions: n/a
Fixed upstream versions: v1.5.11
Upstream repository: https://github.com/hashicorp/go-getter
Upstream fix commit: 36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
CVE-2022-29824: libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write
Component: libxml2
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
Public date: 2022-05-03T00:00:00+00:00

A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-bounds write.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.14
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 2554a2408e09f13652049e5ffb0d26196b02ebab
CVE-2022-2996: python-scciclient: missing server certificate verification
Component: python-scciclient
Severity: Moderate
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2022-06-01T00:00:00+00:00

A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.


Affected upstream versions: 0.11.0
Fixed upstream versions: 0.12.0
Upstream repository: https://opendev.org/x/python-scciclient
Upstream fix commit: 274dca0344b65b4ac113d3271d21c17e970a636c
CVE-2022-29970: sinatra: path traversal possible outside of public_dir when serving static files
Component: sinatra
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-05-02T00:00:00+00:00

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://github.com/sinatra/sinatra
Upstream fix commit: 462c3ca1db53ed3cfc394cf5948e9c948ad1c10e
CVE-2022-3028: kernel: race condition in xfrm_probe_algs can lead to OOB read/write
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-07-21T00:00:00+00:00

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

Statement: This flaw is rated as having a Moderate impact because it can only be triggered by a privileged local user (with CAP_NET_ADMIN or root).

Affected upstream versions: Fixed in kernel 6.0-rc3
Fixed upstream versions: v6.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ba953a9d89a00c078b85f4b190bc1dde66fe16b5
CVE-2022-30594: kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option
Component: kernel
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-05-12T00:00:00+00:00

A flaw was found in the Linux kernel. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag, possibly disabling seccomp.


Affected upstream versions: n/a
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ee1fee900537b5d9560e9f937402de5ddc8412f3
CVE-2022-3064: go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
Component: go-yaml
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-08-29T00:00:00+00:00

A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document.

Statement: RHC package for Red Hat Enterprise Linux 9 mark as Low severity as we do ship the affected code but it's not easily exposed because YAML files are not parsed by RHC.

Affected upstream versions: <= v2.2.3
Fixed upstream versions: 2.2.4
Upstream repository: https://github.com/go-yaml/yaml
Upstream fix commit: f221b8435cfb71e54062f6c6e99e9ade30b124d5
CVE-2022-3077: kernel: i2c: unbounded length leads to buffer overflow in ismt_access()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-06-02T00:00:00+00:00

A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. In particular, the userspace controllable "data->block[0]" variable was not capped to a number between 0-255 and then used as the size of a memcpy, thus possibly writing beyond the end of dma_buffer. This flaw could allow a privileged local user to crash the system.

Statement: Red Hat Enterprise Linux 6, 7 and 8 are not affected by this issue as they did not include support for I2C_SMBUS_BLOCK_PROC_CALL (upstream commit 5e9a97b).

Affected upstream versions: fixed in kernel 5.19
Fixed upstream versions: v5.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 690b2549b19563ec5ad53e5c82f6a944d910086e
CVE-2022-31034: argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI.
Component: argocd
Severity: Important
CWE: CWE-331 (Insufficient Entropy)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-06-15T00:00:00+00:00

Several Single sign-on (SSO) vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the possibility of administrative rights.


Affected upstream versions: >= 0.11.0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5, >= 2.4.0, < 2.4.1
Fixed upstream versions: v2.4.1
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 17f7f4f462bdb233e1b9b36f67099f41052d8cb0
CVE-2022-31035: argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI
Component: argocd
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-06-15T00:00:00+00:00

A Cross-site scripting (XSS) flaw was found in ArgoCD. This flaw allows a malicious actor to trigger a Cross-site scripting (XSS) vulnerability by storing a link point to a javascript code in ArgoCD UI. A successful attack depends on a user clicking the malicious link and triggering the function available in the UI without the user's knowledge. The actions done by the malicious code will run with the same victim's level of access, including administrative privileges, if the victim has this level of permission.


Affected upstream versions: >= 1.0.0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5, >= 2.4.0, < 2.4.1
Fixed upstream versions: v2.4.1
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 8bc3ef690de29c68a36f473908774346a44d4038
CVE-2022-31036: argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access
Component: argocd
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2022-06-15T00:00:00+00:00

A symlink following vulnerability was found in ArgoCD. A malicious user with write access can commit a symlink pointing to a file outside the expected directories. Once the Helm-type application consumes this symlink, the attacker can read the content of the file referenced by the symbolic link, compromising the confidentiality of other projects under the same ArgoCD installation.


Affected upstream versions: >= 1.3.0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5, >= 2.4.0, < 2.4.1
Fixed upstream versions: v2.4.1
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 04c305396458508a31d03d44afea07b1c620d7cd
CVE-2022-3105: kernel: RDMA/uverbs: NULL pointer dereference in uapi_finalize()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-13T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().


Affected upstream versions: Linux 5.16-rc6
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7694a7de22c53a312ea98960fcafc6ec62046531
CVE-2022-31051: semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri encoding
Component: semantic-release
Severity: Moderate
CWE: CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-06-09T00:00:00+00:00

A vulnerability was found in semantic-release. Secrets that are normally masked are accidentally disclosed if they contain characters excluded from uri encoding by `encodeURI()`. The vulnerability is further limited to execution contexts where push access to the related repository is unavailable without modifying the repository URL to inject credentials.


Affected upstream versions: >= 17.0.4, < 19.0.3
Fixed upstream versions: v19.0.3
Upstream repository: https://github.com/semantic-release/semantic-release
Upstream fix commit: 58a226f29c04ee56bbb02cc661f020d568849cad
CVE-2022-3106: kernel: sfc_ef100: NULL pointer dereference in ef100_update_stats()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-13T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().


Affected upstream versions: Linux 5.16-rc6
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 407ecd1bd726f240123f704620d46e285ff30dd9
CVE-2022-3107: kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-13T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.


Affected upstream versions: Linux 5.16-rc6
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 886e44c9298a6b428ae046e2fa092ca52e822e6a
CVE-2022-3108: kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-13T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().


Affected upstream versions: Linux 5.17-rc6
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: abfaf0eee97925905e742aa3b0b72e04a918fa9e
CVE-2022-31116: python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting
Component: python-ujson
Severity: Moderate
CWE: CWE-228 (Improper Handling of Syntactically Invalid Structure)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-02T00:00:00+00:00

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.


Affected upstream versions: < 5.4.0
Fixed upstream versions: 5.4.0
Upstream repository: https://github.com/ultrajson/ultrajson
Upstream fix commit: 67ec07183342589d602e0fcf7bb1ff3e19272687