huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-6974: Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
Component: Kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2019-02-07T00:00:00+00:00

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvm_ioctl_create_device(), the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to a use-after-free issue. A user/process could use this flaw to crash the guest VM resulting in a denial of service issue or, potentially, gain privileged access to a system.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: cfa39381173d5f969daf43582c95ad679189cbc9
CVE-2019-6978: gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c
Component: gd
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-01-15T00:00:00+00:00

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.


Affected upstream versions: n/a
Fixed upstream versions: php-7.4.0
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 089f7c0bc28d399b0420aa6ef058e4c1c120b2ae
CVE-2019-7175: imagemagick: memory leak in function DecodeImage in coders/pcd.c
Component: imagemagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-01-17T00:00:00+00:00

In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-25
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 1e6a3ace073c9ec9c71e439c111d23c6e66cb6ae
CVE-2019-7221: Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer
Component: Kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2019-02-07T00:00:00+00:00

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested (=1) virtualization is enabled. This high resolution timer(hrtimer) runs when a L2 guest is active. After VM exit, the sync_vmcs12() timer object is stopped. The use-after-free occurs if the timer object is freed before calling sync_vmcs12() routine. A guest user/process could use this flaw to crash the host kernel resulting in a denial of service or, potentially, gain privileged access to a system.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Note: Impact on Red Hat Enterprise Linux 7 kernel is limited, as it requires that nested virtualization feature is enabled on a system. Nested Virtualization feature is available only as - Technology Preview.

Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ecec76885bcfe3294685dc363fd1273df0d5d65f
CVE-2019-7222: Kernel: KVM: leak of uninitialized stack contents to guest
Component: Kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 2.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N)
Public date: 2019-02-07T00:00:00+00:00

An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exceptions while emulating instructions like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an operand. It occurs if the operand is a mmio address, as the returned exception object holds uninitialized stack memory contents. A guest user/process could use this flaw to leak host's stack memory contents to a guest.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG 2.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Note:- Impact on Red Hat Enterprise Linux 7 kernel is limited, as it requires that nested virtualization feature is enabled on a system. Nested Virtualization feature is available only as - Technology Preview.

Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 353c0956a618a07ba4bbe7ad00ff29fe70e8412a
CVE-2019-7397: ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-01-17T00:00:00+00:00

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.


Affected upstream versions: n/a
Upstream repository: https://hg.graphicsmagick.org/hg/GraphicsMagick
Upstream fix commit: 11ad3aeb8ab1
CVE-2019-9003: kernel: use-after-free and OOPS in drivers/char/ipmi/ipmi_msghandler.c
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-01-16T00:00:00+00:00

A use-after-free and OOPs flaw was found in the Linux kernel's drivers/char/ipmi/ipmi_msghandler.c code. By arranging certain simultaneous execution of the code accessing IPMI device files, an attacker can cause a denial of service (DoS) attack.


Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 77f8269606bf95fcb232ee86f6da80886f1dfae8
CVE-2019-9169: glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
Component: glibc
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2019-01-20T00:00:00+00:00

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Statement: As per upstream “resource exhaustion issues which can be triggered only with crafted patterns (either during compilation or execution) are not treated as security bugs”. The regular expression compiler in glibc is only supposed to be exposed to trusted content, therefore upstream does not consider this bug as a security vulnerability. (https://sourceware.org/glibc/wiki/Security%20Exceptions)

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.30
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 583dd860d5b833037175247230a328f0050dbfe9
CVE-2019-9213: kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-02-27T00:00:00+00:00

A flaw was found in mmap in the Linux kernel allowing the process to map a null page. This allows attackers to abuse this mechanism to turn null pointer dereferences into workable exploits.


Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0a1d52994d440e21def1c2174932410b4f2a98a1
CVE-2019-9278: libexif: out of bounds write in exif-data.c
Component: libexif
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-12-01T00:00:00+00:00

In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774


Affected upstream versions: Android-10
Fixed upstream versions: libexif-0_6_22-release
Upstream repository: https://github.com/libexif/libexif
Upstream fix commit: 75aa73267fdb1e0ebfbc00369e7312bac43d0566
CVE-2019-9503: kernel: brcmfmac frame validation bypass
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.9 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2019-02-19T00:00:00+00:00

If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a WiFi dongle). This can allow firmware event frames from a remote source to be processed and this can result in denial of service (DoS) condition.


Affected upstream versions: commit prior to a4176ec356c73a46c07c181c6d04039fafa34a9f
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a4176ec356c73a46c07c181c6d04039fafa34a9f
CVE-2020-0305: kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-07-17T00:00:00+00:00

A use-after-free flaw was found in the way the Linux kernel's filesystem subsystem handled a race condition in the chrdev_open function. This flaw allows a privileged local user to starve the resources, causing a denial of service or potentially escalating their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This issue is rated as having Moderate impact because of the preconditions needed to trigger the issue (elevated/root privileges).

Affected upstream versions: Android-10
Fixed upstream versions: v5.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 68faa679b8be1a74e6663c21c3a9d25d32f1c079
CVE-2020-0404: kernel: avoid cyclic entity chains due to malformed USB descriptors
Component: kernel
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-01-16T00:00:00+00:00

A flaw linked list corruption in the Linux kernel for USB Video Class driver functionality was found in the way user connects web camera to the USB port. A local user could use this flaw to crash the system.


Affected upstream versions: Android kernel
Fixed upstream versions: v5.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 68035c80e129c4cfec659aac4180354530b26527
CVE-2020-10029: glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
Component: glibc
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2020-02-12T00:00:00+00:00

A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.

Statement: The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using gcc's stack-protector option which mitigates the possibility of code execution led by the stack corruption.

The glibc version shipped with Red Hat Enterprise Linux 7 is more difficult to exploit using this flaw, specifically for remote code execution. Because exploitation of the flaw depends on the usage of pseudo-zero values, an attacker can only overwrite the stack with 0s. Due to this, a valid address value for code execution is difficult to get and is likely to only result in a crash.

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.32
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 9333498794cde1d5cca518badf79533a24114b6f
CVE-2020-10378: python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files
Component: python-pillow
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-06-25T00:00:00+00:00

A flaw was found in python-pillow. In libImaging/PcxDecode.c, an out-of-bounds read occurs when reading PCX files where state->shuffle is instructed to read beyond state->buffer.


Affected upstream versions: n/a
Fixed upstream versions: 7.1.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: 6a83e4324738bb0452fbe8074a995b1c73f08de7
CVE-2020-10379: python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode()
Component: python-pillow
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-06-25T00:00:00+00:00

In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

Statement: While python-pillow is listed as a dependency of Red Hat Quay, it is not used by the application.

This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they provide an older version of the code which does not include the vulnerable code.

Affected upstream versions: n/a
Fixed upstream versions: 7.1.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: 46f4a349b88915787fea3fb91348bb1665831bbb
CVE-2020-10531: ICU: Integer overflow in UnicodeString::doAppend()
Component: ICU
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-02-25T00:00:00+00:00

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.


Affected upstream versions: n/a
Fixed upstream versions: icu4x/2022-06-30/71.x
Upstream repository: https://github.com/unicode-org/icu
Upstream fix commit: b7d08bc04a4296982fcef8b6b8a354a9e4e7afca
CVE-2020-10543: perl: heap-based buffer overflow in regular expression compiler leads to DoS
Component: perl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2020-06-02T00:00:00+00:00

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

Statement: A heap buffer overflow vulnerability exists in the regular expression compiler of Perl packages shipped with Red Hat Enterprise Linux 6, 7, and 8. The flaw occurs in the S_study_chunk() function of regcomp.c due to a signed size_t integer overflow in storage space calculations for nested regular expression quantifiers. When untrusted regular expressions are compiled, this can lead to out-of-bounds memory writes with attacker-controlled data. The vulnerability does not depend on the data being matched, but rather on the regular expression itself. On Red Hat systems, this could result in denial of service or potential code execution when processing malicious regular expressions. Red Hat customers should not allow untrusted regular expressions to be compiled by the Perl regular expression compiler, as regular expressions in Perl can contain arbitrary code.

Affected upstream versions: n/a
Fixed upstream versions: v5.30.3
Upstream repository: https://github.com/perl/perl5
Upstream fix commit: 897d1f7fd515b828e4b198d8b8bef76c6faf03ed
CVE-2020-10683: dom4j: XML External Entity vulnerability in default SAX parser
Component: dom4j
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-04-15T00:00:00+00:00

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Statement: OpenShift Container Platform ships a vulnerable version of dom4j  library. However it's used to parse configuration files, which are local disk resources. We've rated this issue with a moderate impact for OpenShift Container Platform.

Affected upstream versions: n/a
Fixed upstream versions: version-2.0.3
Upstream repository: https://github.com/dom4j/dom4j
Upstream fix commit: a8228522a99a02146106672a34c104adbda5c658
CVE-2020-10702: qemu: weak signature generation in Pointer Authentication support for ARM
Component: qemu
Severity: Low
CWE: CWE-325 (Missing Cryptographic Step)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-04-02T00:00:00+00:00

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

Statement: Several packages are unaffected because they do not include support for Pointer Authentication. These include:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux for ARM 64 7
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8
* `qemu-kvm-rhev` as shipped with Red Hat OpenStack Platform 10 and 13

Affected upstream versions: >= 4.0.0, < 5.0.0
Fixed upstream versions: v5.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: de0b1bae6461f67243282555475f88b2384a1eb9
CVE-2020-10703: libvirt: Potential denial of service via active pool without target path
Component: libvirt
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-14T00:00:00+00:00

A NULL pointer dereference was found in the libvirt API responsible for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

Statement: Versions of `libvirt` as shipped with Red Hat Enterprise Linux 5 and 6 are marked as "notaffected" as they do not include the vulnerable code, which was introduced in a later version of the package. Specifically, the affected internal function `storagePoolLookupByTargetPathCallback` was introduced in `libvirt` upstream version v3.10.0, whereas the `virStoragePoolLookupByTargetPath` method was exported as a public API in version 4.1.0.

Affected upstream versions: >= 3.10.0, < 6.0.0
Fixed upstream versions: v6.0.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: dfff16a7c261f8d28e3abe60a47165f845fa952f
CVE-2020-10720: kernel: use-after-free read in napi_gro_frags() in the Linux kernel
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-12-09T14:23:00+00:00

A flaw was found in the Linux kernel’s implementation of GRO. This flaw allows an attacker with local access to crash the system.

Statement: This issue is rated as having Moderate impact because it appears to be limited to only to a crash.

Affected upstream versions: Kernel versions before 5.2
Fixed upstream versions: v5.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a4270d6795b0580287453ea55974d948393e66ef
CVE-2020-10732: kernel: uninitialized kernel data leak in userspace coredumps
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2020-05-01T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.


Affected upstream versions: introduced in commit 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: aca969cacf07f41070d788ce2b8ca71f09d5207d
CVE-2020-10739: istio/envoy: crafted packet allows remote attacker to cause denial of service
Component: istio/envoy
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-05-12T18:00:00+00:00

A null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.


Affected upstream versions: >= 1.4.0, < 1.4.9, >= 1.5.0, < 1.5.4
Upstream repository: https://github.com/istio/envoy
Upstream fix commit: 8788a3cf255b647fd14e6b5e2585abaaedb28153
CVE-2020-10751: kernel: SELinux netlink permission check bypass
Component: kernel
Severity: Moderate
CWE: CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Public date: 2020-04-27T14:00:00+00:00

A flaw was found in the Linux kernel’s SELinux LSM hook implementation, where it anticipated the skb would only contain a single Netlink message. The hook incorrectly validated the first Netlink message in the skb only, to allow or deny the rest of the messages within the skb with the granted permissions and without further processing. At this time, there is no known ability for an attacker to abuse this flaw.


Affected upstream versions: before 5.7
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fb73974172ffaaf57a7c42f35424d9aece1a5af6