huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-3821: systemd: buffer overrun in format_timespan() function
Component: systemd
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-08T00:00:00+00:00

An off-by-one error flaw was found in systemd in the format_timespan() function of time-util.c. This flaw allows an attacker to supply specific values for time and accuracy, leading to a buffer overrun in format_timespan(), leading to a denial of service.

Statement: Network Manager uses systemd's format_timespan() only via the FORMAT_TIMESPAN() macro which allocates a 64-byte buffer on the stack.

The longest string representing 32bit values in seconds doesn't exceed 34 bytes (for example, "134y 10month 10w 1d 10h 10min 10s"). Since all the values are in exact seconds there is no decimal part to print.

Therefore, it doesn't seem possible to trigger the buffer overflow by returning a specially crafted DHCPv6 lease, and the CVE doesn't affect Network Manager.

Affected upstream versions: Fixed in systemd v252-rc1
Fixed upstream versions: v252
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: 9102c625a673a3246d7e73d8737f3494446bad4e
CVE-2022-39188: kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-06T16:30:00+00:00

A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition (unmap_mapping_range versus munmap). This issue allows a device driver to free a page while it still has stale TLB entries.

Statement: This issue only occurs in situations with VM_PFNMAP virtual memory areas (VMAs).

Affected upstream versions: n/a
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b67fbebd4cf980aecbcc750e1462128bffe8ae15
CVE-2022-39189: kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning
Component: kernel
Severity: Moderate
CWE: CWE-368 (Context Switching Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-30T03:30:00+00:00

A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.

Statement: With the current usecase, attacker need a root privileges to exploit this flaw, however there may have ways to defeat this either, but in both cases it seems that Attack Complexity is high (AC:H)

Affected upstream versions: n/a
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6cd88243c7e03845a450795e134b488fc2afb736
CVE-2022-39190: kernel: nf_tables disallow binding to already bound chain
Component: kernel
Severity: Moderate
CWE: CWE-392 (Missing Report of Error Condition)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-08-21T22:30:00+00:00

A flaw was found in net/netfilter/nf_tables_api.c in the Linux kernel. A denial of service can occur upon binding to an already bound chain.


Affected upstream versions: n/a
Fixed upstream versions: v6.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: e02f0d3970404bfea385b6edb86f2d936db0ea2b
CVE-2022-39201: grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
Component: grafana
Severity: Moderate
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-10-14T00:00:00+00:00

A flaw was found in Grafana. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. Grafana could leak the authentication cookie of users to plugins, which could result in an impact to confidentiality, integrity, and availability.


Affected upstream versions: >= v5.0.0-beta1, < 8.5.14, >= 9.0.0, < 9.1.8
Fixed upstream versions: v9.1.8
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: b571acc1dc130a33f24742c1f93b93216da6cf57
CVE-2022-39222: dexidp: gaining access to applications accepting that token
Component: dexidp
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2022-10-06T00:00:00+00:00

A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue; Users are advised to upgrade.


Affected upstream versions: < 2.35.0
Fixed upstream versions: api/v2.2.0
Upstream repository: https://github.com/dexidp/dex
Upstream fix commit: 49471b14c8080ddb034d4855841123d378b7a634
CVE-2022-39229: grafana: using email as a username can block other users from signing in
Component: grafana
Severity: Moderate
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2022-10-14T00:00:00+00:00

A flaw was found in the Grafana web application. When a user logs into the system, either the username or email address can be used. However, the login system allows both a username and connected email to be registered, which could allow an attacker to prevent a user which has an associated email address access.


Affected upstream versions: >= 9.0.0, < 9.1.8, >= 8.5.0, < 8.5.14
Fixed upstream versions: v8.5.14
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: 5644758f0c5ae9955a4e5480d71f9bef57fdce35
CVE-2022-39236: Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue
Component: Mozilla
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2022-09-28T00:00:00+00:00

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially cause data integrity issues by sending specially crafted messages.


Affected upstream versions: >= 17.1.0-rc.1, < 19.7.0
Fixed upstream versions: v19.7.0
Upstream repository: https://github.com/matrix-org/matrix-js-sdk
Upstream fix commit: a587d7c36026fe1fcf93dfff63588abee359be76
CVE-2022-39249: Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators
Component: Mozilla
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2022-09-28T00:00:00+00:00

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator could fake encrypted messages to look as if they were sent from another user on that server.


Affected upstream versions: < 19.7.0
Fixed upstream versions: v19.7.0
Upstream repository: https://github.com/matrix-org/matrix-js-sdk
Upstream fix commit: a587d7c36026fe1fcf93dfff63588abee359be76
CVE-2022-39250: Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack
Component: Mozilla
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2022-09-28T00:00:00+00:00

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. A malicious server administrator could interfere with cross-device verification to authenticate their own device.


Affected upstream versions: < 19.7.0
Fixed upstream versions: v19.7.0
Upstream repository: https://github.com/matrix-org/matrix-js-sdk
Upstream fix commit: a587d7c36026fe1fcf93dfff63588abee359be76
CVE-2022-39251: Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack
Component: Mozilla
Severity: Important
CWE: CWE-322 (Key Exchange without Entity Authentication)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2022-09-28T00:00:00+00:00

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. An attacker could spoof historical messages from other users, and use a malicious key backup to the user's account under specific conditions in order to exfiltrate message keys.


Affected upstream versions: < 19.7.0
Fixed upstream versions: v19.7.0
Upstream repository: https://github.com/matrix-org/matrix-js-sdk
Upstream fix commit: a587d7c36026fe1fcf93dfff63588abee359be76
CVE-2022-39316: freerdp: out of bounds read in zgfx decoder
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-11-16T00:00:00+00:00

An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service.


Affected upstream versions: < 2.9.0
Fixed upstream versions: 2.9.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: e865c24efc40ebc52e75979c94cdd4ee2c1495b0
CVE-2022-39318: freerdp: division by zero in urbdrc channel
Component: freerdp
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-11-16T00:00:00+00:00

A division-by-zero issue was found in FreeRDP's libusb_udevice.c in the urbdrc channel. This flaw exists due to missing input validation in the urbdrc channel. A malicious server can pass specially crafted data to the client, causing a crash and denial of service.


Affected upstream versions: < 2.9.0
Fixed upstream versions: 2.9.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea
CVE-2022-39319: freerdp: missing length validation in urbdrc channel
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L)
Public date: 2022-11-16T00:00:00+00:00

An out-of-bound read vulnerability was discovered in FreeRDP due to improper input length validation in client/data_transfer.c in the urbdrc channel. A malicious server can trigger an out-of-bounds read by tricking a FreeRDP based client to read out-of-bound data and send it back to the server.

Statement: Do not use the /usb redirection switch.

Affected upstream versions: < 2.9.0
Fixed upstream versions: 2.9.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 11555828d2cf289b350baba5ad1f462f10b80b76
CVE-2022-39324: grafana: Spoofing of the originalUrl parameter of snapshots
Component: grafana
Severity: Moderate
CWE: CWE-472 (External Control of Assumed-Immutable Web Parameter)
CVSS v3: 6.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L)
Public date: 2023-01-30T00:00:00+00:00

A flaw was found in the grafana package. While creating a snapshot, an attacker may manipulate a hidden HTTP parameter to inject a malicious URL in the "Open original dashboard" button.

Statement: OpenShift Service Mesh containers include the Grafana RPM from RHEL and consume CVE fixes for Grafana from RHEL channels. The servicemesh-grafana RPM shipped in early versions of OpenShift Service Mesh 2.1 is no longer maintained.

Affected upstream versions: < 8.5.16, >= 9.0.0, < 9.2.8
Fixed upstream versions: v0.0.0-cloud
Upstream repository: https://github.com/grafana/grafana
Upstream fix commit: 239888f22983010576bb3a9135a7294e88c0c74a
CVE-2022-39347: freerdp: missing path sanitation with `drive` channel
Component: freerdp
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N)
Public date: 2022-11-16T00:00:00+00:00

A directory traversal issue was discovered in FreeRDP. The vulnerability exists due to missing path canonicalization and base path check for the drive channel. A malicious server can trick a FreeRDP based client to read files outside of the shared directory. This issue allows an attacker to gain access to sensitive information.


Affected upstream versions: < 2.9.0
Fixed upstream versions: 2.9.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 027424c2c6c0991cb9c22f9511478229c9b17e5d
CVE-2022-39368: scandium: Failing DTLS handshakes may cause throttling to block processing of records
Component: scandium
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2022-11-10T00:00:00+00:00

A flaw was found in the Eclipse Californium Scandium package. This issue occurs when failing handshakes don't clean up counters for throttling, causing the threshold to be reached without being released again, resulting in a denial of service. An attacker could submit a high quantity of server requests, leaving the server unable to respond.


Affected upstream versions: >= 2.7.0, < 2.7.4, >= 3.0.0, < 3.7.0
Fixed upstream versions: 2.7.4
Upstream repository: https://github.com/eclipse-californium/californium
Upstream fix commit: 5648a0c27c2c2667c98419254557a14bac2b1f3f
CVE-2022-3970: libtiff: integer overflow in function TIFFReadRGBATileExt of the file
Component: libtiff
Severity: Moderate
CWE: CWE-680 (Integer Overflow to Buffer Overflow)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-11-08T00:00:00+00:00

An integer overflow flaw was found in LibTIFF. This issue exists in the TIFFReadRGBATileExt function of the libtiff/tif_getimage.c file, and may lead to a buffer overflow.

Statement: Red Hat Product security rated this issue having Moderate security impact as the exploitation of this issue will most likely to cause a denial of service attack. The score is based on the worst case scenario that an attacker might use the integer overflow to trigger other vulnerabilities such as buffer overflow, that could result in more adverse effects.

Affected upstream versions: n/a
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 227500897dfb07fb7d27f7aa570050e62617e3be
CVE-2022-40023: python-mako: REDoS in Lexer class
Component: python-mako
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-09-07T00:00:00+00:00

A vulnerability was found in the mako package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.


Affected upstream versions: n/a
Fixed upstream versions: rel_1_2_2
Upstream repository: https://github.com/sqlalchemy/mako
Upstream fix commit: 925760291d6efec64fda6e9dd1fd9cfbd5be068c
CVE-2022-40303: libxml2: integer overflows with XML_PARSE_HUGE
Component: libxml2
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-14T00:00:00+00:00

A flaw was found in libxml2. Parsing a XML document with the XML_PARSE_HUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.

Statement: This flaw is only triggered when parsing a multi-gigabyte XML document with the XML_PARSE_HUGE option enabled, and the most likely impact of this flaw is a Denial of Service in the application linked to the library. To reflect these conditions, Red Hat Product Security has rated this flaw as having a moderate security impact.

Affected upstream versions: n/a
Fixed upstream versions: v2.10.3
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: c846986356fc149915a74972bf198abc266bc2c0
CVE-2022-40304: libxml2: dict corruption caused by entity reference cycles
Component: libxml2
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-10-14T00:00:00+00:00

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.

Statement: The most likely impact of this flaw is a Denial of Service in the application linked to the library. To reflect this, Red Hat Product Security has rated this flaw as having a moderate security impact.

Affected upstream versions: n/a
Fixed upstream versions: v2.10.3
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 1b41ec4e9433b05bb0376be4725804c54ef1d80b
CVE-2022-40897: pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py
Component: pypa-setuptools
Severity: Moderate
CWE: CWE-185 (Incorrect Regular Expression)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-22T00:00:00+00:00

A flaw was found in Python Setuptools due to a regular expression Denial of Service (ReDoS) present in package_index.py. This issue could allow a remote attacker to cause a denial of service via HTML in a crafted package or custom PackageIndex page.


Affected upstream versions: n/a
Fixed upstream versions: v65.5.1
Upstream repository: https://github.com/pypa/setuptools
Upstream fix commit: 43a9c9bfa6aa626ec2a22540bea28d2ca77964be
CVE-2022-41218: kernel: Report vmalloc UAF in dvb-core/dmxdev
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-09-23T08:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: Keeping this issue Moderate because the impact is limited: only when the user uses the dvb-core module and removes the USB device triggers the attack. This kind of race condition is hard to trigger and requires several preconditions.

Affected upstream versions: n/a
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fd3d91ab1c6ab0628fe642dd570b56302c30a792
CVE-2022-41222: kernel: mm/mremap.c use-after-free vulnerability
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-07T09:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code in how a race condition happens between rmap walk and mremap. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 97113eb39fa7972722ff490b947d8af023e1f6a2
CVE-2022-4128: kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-11T00:00:00+00:00

A NULL pointer dereference issue was discovered in the Linux kernel. This issue occurs in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could potentially crash the system, causing a denial of service.


Affected upstream versions: Fixed in 5.19
Fixed upstream versions: v5.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5c835bb142d4
CVE-2022-41323: python-django: Potential denial-of-service vulnerability in internationalized URLs
Component: python-django
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-04T00:00:00+00:00

A denial of service flaw was discovered in Django. This issue occurs when incorrectly handling certain internationalized URLs. A malicious attacker could use this issue to cause a crash, resulting in a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: stable/3.2.x
Upstream repository: https://github.com/django/django
Upstream fix commit: 5b6b257fa7ec37ff27965358800c67e2dd11c924
CVE-2022-41674: kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2022-10-13T10:00:00+00:00

A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_nontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows an attacker to crash the system or leak internal kernel information.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git
Upstream fix commit: aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d
CVE-2022-4172: QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record
Component: QEMU
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2022-10-19T00:00:00+00:00

An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host. Arbitrary code execution was deemed unlikely.

Statement: Red Hat Enterprise Linux 6, 7, 8 and RHEL Advanced Virtualization are not affected by this CVE as they did not include support for ACPI ERST (introduced upstream in version 7.0.0).

Affected upstream versions: Affected: 7.0.0, Fixed: 7.2.0-rc0
Fixed upstream versions: v7.2.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: defb7098
CVE-2022-41858: kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2022-04-05T15:30:00+00:00

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.


Affected upstream versions: unknown
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ec4eb8a86ade4d22633e1da2a7d85a846b7d1798