huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-0466: openssl: Certificate policy check not enabled
Component: openssl
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-03-28T00:00:00+00:00

A flaw was found in OpenSSL. The X509_VERIFY_PARAM_add0_policy() function is documented to enable the certificate policy check when doing certificate verification implicitly. However, implementing the function does not enable the check, allowing certificates with invalid or incorrect policies to pass the certificate verification. Suddenly enabling the policy check could break existing deployments, so it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. The applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

Statement: This vulnerability is rated as moderate because OpenSSL's X509_VERIFY_PARAM_add0_policy() function does not properly enable certificate policy checks as documented. As a result, certificates with invalid or incorrect policies may pass verification, it could lead to policy enforcement issues in applications that rely on this function without explicitly enabling policy checks.

Affected upstream versions: 3.1.0 < 3.1.1, 3.0.0 < 3.0.9, 1.1.1 < 1.1.1u, 1.0.2 < 1.0.2zh
Fixed upstream versions: 1.0.2zh, 1.1.1u, 3.0.9, 3.1.1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: fc814a30fc4f0bc54fcea7d9a7462f5457aab061
CVE-2023-0482: RESTEasy: creation of insecure temp files
Component: RESTEasy
Severity: Low
CWE: CWE-378 (Creation of Temporary File With Insecure Permissions)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2023-01-31T00:00:00+00:00

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.


Affected upstream versions: Fixed in RESTEasy 4.7.8.Final
Fixed upstream versions: v7.0.0.Final
Upstream repository: https://github.com/resteasy/resteasy
Upstream fix commit: 807d7456f2137cde8ef7c316707211bf4e542d56
CVE-2023-0494: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
Component: xorg-x11-server
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-07T00:00:00+00:00

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore Red Hat Enterprise Linux 8 and 9 have been rated with Moderate severity.

Affected upstream versions: xorg-server 21.1.7
Fixed upstream versions: xwayland-23.0.99.901
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 0ba6d8c37071131a49790243cdac55392ecf71ec
CVE-2023-0664: QEMU: local privilege escalation via the QEMU Guest Agent on Windows
Component: QEMU
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-20T00:00:00+00:00

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.

Statement: This flaw has been rated as having a security impact of Moderate. The flaw affects Windows VMs using virtio-win drivers with QEMU Guest Agent installed in the guest. This is not a VM escape vulnerability, meaning that it does not allow a malicious user to break out of the guest.

Affected upstream versions: unknown
Fixed upstream versions: v8.0.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: 88288c2a51faa7c795f053fc8b31b1c16ff804c5
CVE-2023-0795: libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractContigSamplesShifted16bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited information disclosure.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: afaabc3e50d4e5d80a94143f7e3c997e7e410f68
CVE-2023-0796: libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractContigSamplesShifted24bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited information disclosure.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: afaabc3e50d4e5d80a94143f7e3c997e7e410f68
CVE-2023-0797: libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the _TIFFmemcpy function in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c, resulting in a Denial of Service and limited information disclosure.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: afaabc3e50d4e5d80a94143f7e3c997e7e410f68
CVE-2023-0798: libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractContigSamplesShifted8bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited information disclosure.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: afaabc3e50d4e5d80a94143f7e3c997e7e410f68
CVE-2023-0799: libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to a use-after-free problem in the extractContigSamplesShifted32bits function in tools/tiffcrop.c, resulting in a Denial of Service.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: afaabc3e50d4e5d80a94143f7e3c997e7e410f68
CVE-2023-0800: libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the extractContigSamplesShifted16bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 33aee1275d9d1384791d2206776eb8152d397f00
CVE-2023-0801: libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the _TIFFmemcpy function in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 33aee1275d9d1384791d2206776eb8152d397f00
CVE-2023-0802: libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the extractContigSamplesShifted32bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 33aee1275d9d1384791d2206776eb8152d397f00
CVE-2023-0803: libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the extractContigSamplesShifted16bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 33aee1275d9d1384791d2206776eb8152d397f00
CVE-2023-0804: libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2023-02-12T00:00:00+00:00

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds write in the extractContigSamplesShifted24bits function in tools/tiffcrop.c, resulting in a Denial of Service and limited data modification.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 33aee1275d9d1384791d2206776eb8152d397f00
CVE-2023-0809: mosquitto: memory leak leads to unresponsive broker
Component: mosquitto
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-01T00:00:00+00:00

A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition.


Affected upstream versions: <= v2.0.15
Fixed upstream versions: 2.0.16
Upstream repository: https://github.com/eclipse/mosquitto
Upstream fix commit: 6113eac95a9df634fbc858be542c4a0456bfe7b9
CVE-2023-0836: haproxy: data leak via fcgi requests
Component: haproxy
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-12-09T00:00:00+00:00

A flaw was found in HAProxy, which could allow a remote attacker to obtain sensitive information caused by improper initialization when encoding the FCGI_BEGIN_REQUEST record. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.


Affected upstream versions: HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27
Fixed upstream versions: v2.8.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: 2e6bf0a
CVE-2023-1073: kernel: HID: check empty report_list in hid_validate_values()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-17T00:00:00+00:00

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: unknown
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: b12fece4c64857e5fab4290bf01b2e0317a88456
CVE-2023-1074: kernel: sctp: fail if no bound addresses can be used for a given scope
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-23T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service.


Affected upstream versions: unknown
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: 458e279f861d3f61796894cd158b780765a1569f
CVE-2023-1075: kernel: net/tls: tls_is_tx_ready() checked list_entry
Component: kernel
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-01-28T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's TLS protocol. This issue could allow a local user unauthorized access to some memory.


Affected upstream versions: unknown
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: ffe2a22562444720b05bdfeb999c03e810d84cbb
CVE-2023-1076: kernel: tap: tap_open(): correctly initialize socket uid
Component: kernel
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and get unauthorized access to some resources.


Affected upstream versions: unknown
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: 66b2c338adce580dfce2199591e65e2bab889cff
CVE-2023-1079: kernel: hid: Use After Free in asus_remove()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-12T00:00:00+00:00

A use-after-free flaw was found in asus_kbd_backlight_set in drivers/hid/hid-asus.c in the Linux Kernel. This issue could allow an attacker to crash the system when plugging in or disconnecting a malicious USB device, which may lead to a kernel information leak problem.


Affected upstream versions: unknown
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Upstream fix commit: 4ab3a086d10eeec1424f2e8a968827a6336203df
CVE-2023-1095: kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-08-09T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel’s netfilter subsystem. The issue could occur due to an error in nf_tables_updtable while freeing a transaction object not placed on the list head. This flaw allows a local, unprivileged user to crash the system, resulting in a denial of service.


Affected upstream versions: Fixed in 6.0-rc1
Fixed upstream versions: v6.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 580077855a40741cf511766129702d97ff02f4d9
CVE-2023-1118: kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-10T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's integrated infrared receiver/transceiver driver. This issue occurs when a user detaches a rc device. This could allow a local user to crash the system or potentially escalate their privileges on the system.

Statement: Because this vulnerability requires an attacker to either have physical access to a system with infrared receiver/transceiver hardware or requires a remote authenticated user to have knowledge about such hardware attached to the system and when it is disconnected, Red Hat assesses the impact of this vulnerability as Moderate.

This bug stems from an error in drivers/media/rc/ene_ir.c. This is no longer being built, as CONFIG_IR_ENE is no longer enabled in Red Hat Enterprise Linux 9.

Affected upstream versions: Linux kernel 6.3-rc1
Fixed upstream versions: v6.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 29b0589a865b6f66d141d79b2dd1373e4e50fe17
CVE-2023-1192: kernel: use-after-free in smb2_is_status_io_timeout()
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-02T00:00:00+00:00

A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.

Statement: Because analysis indicates that this issue will only cause momentary interruptions to connections, Red Hat rates the impact of this flaw as Low.

Affected upstream versions: <= v6.5
Fixed upstream versions: v6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: d527f51331cace562393a8038d870b3e9916686f
CVE-2023-1195: kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-02T06:30:00+00:00

A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an invalid pointer request.


Affected upstream versions: prior to kernel 6.1 rc3
Fixed upstream versions: v6.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 153695d36ead0ccc4d0256953c751cabf673e621
CVE-2023-1255: openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM
Component: openssl
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-20T00:00:00+00:00

A vulnerability was found in OpenSSL. This security flaw occurs because the AES-XTS cipher decryption implementation for the 64-bit ARM platform contains an issue that could cause it to read past the input buffer, leading to a crash.

Statement: Applications that use the AES-XTS algorithm on the 64-bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually for disk encryption.

The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5, for example, 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash, resulting in a denial of service. 

The application is affected if an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64-bit ARM. This is fairly unlikely, making this issue a Low severity one.

Affected upstream versions: 3.1.0 < 3.1.1, 3.0.0 < 3.0.9
Fixed upstream versions: 3.0.9, 3.1.1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: bc2f61ad70971869b242fc1cb445b98bad50074a
CVE-2023-1281: kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege escalation
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-23T06:30:00+00:00

A use-after-free vulnerability was found in the traffic control index filter (tcindex) in the Linux kernel. The imperfect hash area can be updated while packets are traversing. This issue could allow a local attacker to cause a use-after-free problem, leading to privilege escalation.

Statement: For the Red Hat Enterprise Linux 7, please use mitigation to disable module cls_tcindex, because some other bugs exists in the Linux Kernel traffic control index filter too that not going to be fixed before Red Hat Enterprise Linux 8.

Affected upstream versions: 4.14 <= 6.2
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ee059170b1f7e94e55fa6cadee544e176a6e59c2
CVE-2023-1390: kernel: remote DoS in TIPC kernel module
Component: kernel
Severity: Important
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-01-09T00:00:00+00:00

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this issue as they did not include the affected code in `tipc_link_xmit`, introduced in upstream kernel version 4.3 (commit af9b028 "tipc: make media xmit call outside node spinlock context").

Affected upstream versions: Fixed in kernel 5.11-rc4
Fixed upstream versions: v5.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b77413446408fdd256599daf00d5be72b5f3e7c6