vdanen/rhvex-cve huggingface dataset:
CVE-2024-45490 (Moderate severity, published 2024-08-29)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-190
Description: A flaw was found in libexpat's xmlparse.c component. This vulnerability allows an attacker to cause improper handling of XML data by providing a negative length value to the XML_ParseBuffer function.
Statement: The CVE-2024-45490 vulnerability is rated as moderate severity because while it allows for memory corruption through improper argument handling in XML_ParseBuffer, the exploitability is limited. Specifically, it requires an unlikely scenario where the input passed to the function has a negative length (len < 0), which would typically not occur in well-formed applications. Moreover, while the impact includes denial of service (DoS), the conditions necessary for arbitrary code execution are non-trivial, requiring specific exploitation of memory corruption. Since it primarily leads to application crashes without an easily accessible attack vector for remote code execution, the risk is lower compared to higher-severity vulnerabilities that offer more direct pathways to exploitation.

Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-190: Integer Overflow or Wraparound vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.

Baseline configurations and configuration controls enforce secure system and software settings, while least functionality reduces the attack surface by disabling unnecessary services and ports. In the event of successful exploitation, process isolation ensures that memory corruption is contained within the originating process, preventing it from affecting other processes or the system as a whole. The environment leverages malicious code protections such as IPS/IDS and antimalware solutions. These controls help detect and prevent malicious code that attempts to exploit integer overflow vulnerabilities through mechanisms like file integrity checks and patch management. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are used to enhance resilience against integer overflows and denial-of-service attacks.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-56746 (Moderate severity, published 2024-12-28)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-401
Description: In the Linux kernel, the following vulnerability has been resolved:

fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()

When information such as info->screen_base is not ready, calling
sh7760fb_free_mem() does not release memory correctly. Call
dma_free_coherent() instead.
CVE-2024-6874 (Low severity, published 2024-07-23)
CVSS score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CWE: CWE-126
Description: A buffer overread vulnerability was found in Curl's URL API function curl_url_get(). This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive information and potentially launch further attacks against the affected system.
Statement: This bug was introduced in the Curl 8.8.0 release. However, Red Hat has not yet included Curl 8.8.0 in any of its products.

Additionally, since this vulnerability only affects MacOS builds, Red Hat remains unaffected.
CVE-2024-35792 (Moderate severity, published 2024-05-16)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Description: A vulnerability was found in the Linux kernel's rockchip rk3288_crypto_ahash.c driver in the rk_hash_run() function, where a use-after-free scenario can occur. This flaw is caused by improper function call ordering, where  rk_hash_unprepare() is called after crypto_finalize_hash_request(). This may free some of the memory used by rk_hash_unprepare() and lead to a use-after-free, possibly leading to memory corruption or system instability.
Statement: Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-24479 (Moderate severity, published 2024-02-20)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-119
Description: A flaw was found in Wireshark. This issue allows a remote attacker to trigger a buffer overflow in the format_fractional_part_nsecs function in the wsutil/to_str.c file, resulting in a denial of service.
Statement: The Wireshark package as shipped in Red Hat Enterprise Linux 7, 8 and 9 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of Wireshark.
CVE-2024-36014 (Moderate severity, published 2024-05-28)
CVSS score: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: A null pointer dereference vulnerability was found in the Linux kernel. In malidp_mw_connector_reset, new memory is allocated with kzalloc but no check is performed.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-26917 (Moderate severity, published 2024-04-16)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-833
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"

This reverts commit 1a1975551943f681772720f639ff42fbaa746212.

This commit causes interrupts to be lost for FCoE devices, since it changed
sping locks from "bh" to "irqsave".

Instead, a work queue should be used, and will be addressed in a separate
commit.
Statement: Red Hat Enterprise Linux 8 and 9 is not affected by this vulnerability.
CVE-2024-25638 (Important severity, published 2024-07-21)
CVSS score: 8.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)
CWE: CWE-349
Description: A flaw was found in the dnsjava package, a DNS implementation written in the Java language. The dnsjava package does not properly check the DNS resource records (RR) relevancy to the DNS query being processed, allowing an attacker to respond to the DNS request with RRs from different zones. This issue may lead to data integrity and confidentiality issues for applications, which due to DNSSEC specifications, might assume the returned RRs are authentic.
Statement: This vulnerability in the dnsjava package is of important severity due to its potential to undermine the foundational security mechanisms of DNS-based applications. The improper validation of DNS resource records (RRs) allows an attacker to inject records from unauthorized DNS zones, effectively bypassing the integrity checks that DNSSEC is designed to enforce. This flaw not only compromises the authenticity of DNS responses but also opens the door to sophisticated attacks such as DNS cache poisoning and redirection to malicious servers. 

Red Hat JBoss Enterprise Application Platform 7 & 8 was not affected by this CVE.
Mitigation: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVE-2024-41083 (Moderate severity, published 2024-07-28)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: A flaw was found in `netfs_page_mkwrite()` in the Linux kernel caused by a missing validation check for `folio->mapping` after acquiring the folio lock. This oversight could lead to a NULL pointer dereference, resulting in kernel crashes when handling file operations. The issue arose from interference by `invalidate_inode_pages2_range()` during Direct I/O (DIO) writes.
Statement: Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-26852 (Moderate severity, published 2024-04-16)
CVSS score: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-416
Description: A use-after-free flaw was found in ip6_route_mpath_notify() in the Linux kernel. This may lead to a crash.
CVE-2024-53051 (Low severity, published 2024-11-18)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability

Sometimes during hotplug scenario or suspend/resume scenario encoder is
not always initialized when intel_hdcp_get_capability add
a check to avoid kernel null pointer dereference.
CVE-2024-56603 (Moderate severity, published 2024-12-26)
CVSS score: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CWE: CWE-416
Description: In the Linux kernel, the following vulnerability has been resolved:

net: af_can: do not leave a dangling sk pointer in can_create()

On error can_create() frees the allocated sk object, but sock_init_data()
has already attached it to the provided sock object. This will leave a
dangling sk pointer in the sock object and may cause use-after-free later.
Statement: This issue is considered to be a moderate impact flaw. It seems the data exposed in this case is specific to network protocol stack and not of all kernel space.
CVE-2024-57911 (Moderate severity, published 2025-01-18)
CVSS score: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
CWE: CWE-908
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

The 'data' array is allocated via kmalloc() and it is used to push data
to user space from a triggered buffer, but it does not set values for
inactive channels, as it only uses iio_for_each_active_channel()
to assign new values.

Use kzalloc for the memory allocation to avoid pushing uninitialized
information to userspace.
CVE-2024-27039 (Moderate severity, published 2024-04-30)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Description: An erroneous devm_kfree() flaw was found in the Linux kernel in drivers/clk/hisilicon/clk-hi3559a.c. This issue may lead to a crash.
CVE-2024-35907 (Moderate severity, published 2024-05-18)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Description: CVE-2024-35907 is a vulnerability in the Linux kernel's mlxbf_gige driver, which supports Mellanox BlueField devices. The issue occurs during kdump operations when a receive (RX) interrupt is triggered before the driver fully initializes. This leads to a race condition that can result in a NULL pointer dereference, causing the system to crash.

A pending RX interrupt before the driver requests the IRQ can lead to an improper sequence of operations, resulting in the crash.

This flaw affects system stability during kdump operations, potentially causing kernel panics.
CVE-2024-39477 (Low severity, published 2024-07-04)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-99
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: do not call vma_add_reservation upon ENOMEM

sysbot reported a splat [1] on __unmap_hugepage_range().  This is because
vma_needs_reservation() can return -ENOMEM if
allocate_file_region_entries() fails to allocate the file_region struct
for the reservation.

Check for that and do not call vma_add_reservation() if that is the case,
otherwise region_abort() and region_del() will see that we do not have any
file_regions.

If we detect that vma_needs_reservation() returned -ENOMEM, we clear the
hugetlb_restore_reserve flag as if this reservation was still consumed, so
free_huge_folio() will not increment the resv count.

[1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa
CVE-2024-26628 (Moderate severity, published 2024-03-05)
CVSS score: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
CWE: CWE-20
Description: [REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix lock dependency warning
Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/20240320164818.3778843-2-lee@kernel.org/
CVE-2024-38636 (Moderate severity, published 2024-06-20)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-20
Description: A vulnerability was found in the Flash-Friendly File System (F2FS) in the Linux kernel, where the system failed to correctly recognize valid zero block addresses in multi-device configurations. This issue could potentially lead to improper handling of data or file system errors.
Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-45306 (Low severity, published 2024-09-02)
CVSS score: 4.5 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
CWE: CWE-122
Description: A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was unnecessary. However, this change made it possible for the cursor position to stay invalid and point beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position.
Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Since Red Hat Enterprise Linux 6, 7 are Out-of-Support-Scope for Low/Moderate flaws, the issue is not currently planned to be addressed in future updates for RHEL-6,7. Only Important and Critical severity flaws will be addressed at this time.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.
CVE-2024-42139 (Moderate severity, published 2024-07-29)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: A vulnerability was found in the Linux kernel's ethernet ice driver, where EXTTS events are improperly handled. If the driver is removed while the managing application is running, certain EXTT events might remain enabled. This issue can lead to system instability and crashes.
Statement: Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-476: NULL Pointer Dereference vulnerability and downgrades the severity of this particular CVE from Moderate to Low.

The platform incorporates secure engineering principles and controls to enforce secure coding practices, including proper memory handling and error checking, reducing the likelihood of null pointer dereference vulnerabilities. Coding standards, tools, and processes support early detection and prevention of memory-related flaws. Static code analysis identifies null dereference and related issues during development, while system monitoring detects memory errors and anomalous behavior in the event of exploitation. Additionally, the platform leverages memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to strengthen resilience against memory-related vulnerabilities.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-42093 (Moderate severity, published 2024-07-28)
CVSS score: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
CWE: CWE-121
Description: A potential stack overflow flaw was found in the Linux kernel’s DPAA2 ethernet driver. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Statement: Red Hat Enterprise Linux not affected.

To successfully exploit this bug, an attacker must be able to access sensitive data from kernel memory — like secrets, credentials, or system state.

But this bug is:

* A stack overflow (not a read or leak),
* Occurring inside a kernel driver during internal processing,
* With no known exploit that leaks data from memory.
So unless it can be exploited to leak data, C:L is more appropriate.
CVE-2024-53682 (Low severity, published 2025-01-10)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: axp20x: AXP717: set ramp_delay

AXP717 datasheet says that regulator ramp delay is 15.625 us/step,
which is 10mV in our case.

Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to
expand to AXP_DESC_RANGES_DELAY with ramp_delay = 0

For DCDC4, steps is 100mv

Add a AXP_DESC_DELAY macro and update AXP_DESC macro to
expand to AXP_DESC_DELAY with ramp_delay = 0

This patch fix crashes when using CPU DVFS.
CVE-2024-21047 (Moderate severity, published 2024-04-15)
CVSS score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Description: A flaw was found in the MySQL Server product of Oracle MySQL (component: InnoDB). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CVE-2024-46896 (Low severity, published 2025-01-10)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-119
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: don't access invalid sched

Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
accessing job->base.sched can produce unexpected results as the initialisation
of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
memset.

This commit fixes an issue when a CS would fail validation and would
be rejected after job->num_ibs is incremented. In this case,
amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
machine because the ring value is bogus.

To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
because the device is actually not used in this function.

The next commit will remove the ring argument completely.

(cherry picked from commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7)
CVE-2024-24750 (Moderate severity, published 2024-02-15)
CVSS score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-400
Description: An uncontrolled resource consumption flaw was found in undici. Calling `fetch(url)` and not consuming the incoming body or consuming it very slowly leads to a memory leak.
Statement: Users unable to upgrade should make sure to always consume the incoming body.
CVE-2024-21102 (Moderate severity, published 2024-04-15)
CVSS score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Description: A flaw was found in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CVE-2024-9902 (Moderate severity, published 2024-11-06)
CVSS score: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L)
CWE: CWE-863
Description: A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
Mitigation: In the play that uses the user module with the key generation option,
have a prior task ensuring the public key does not exist for example:

- name: avoid user exploit (change name depending on other options
used in user task)
file: path=/home/{{username}}/.ssh/id_rsa.pub state=absent
CVE-2024-35842 (Moderate severity, published 2024-05-16)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Description: A vulnerability was found in the sof-common code in the Linux Kernel's Mediatek ASoC driver. This issue involves a NULL pointer dereference due to a lack of proper NULL checks for the normal_link string, and could lead to crashes or unpredictable behavior in the kernel.
Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2024-34750 (Important severity, published 2024-07-02)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-755
Description: A vulnerability was found in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This issue led to a miscounting of active HTTP/2 streams, which in turn led to using an incorrect infinite timeout that allowed connections to remain open that should have been closed.
Statement: This vulnerability in Apache Tomcat is significant due to its impact on the stability and security of web applications relying on HTTP/2. The improper handling of excessive HTTP headers during HTTP/2 stream processing leads to an inaccurate count of active streams. This miscount causes the application to apply an incorrect infinite timeout, allowing connections to persist indefinitely. Such behavior results in uncontrolled resource consumption, potentially exhausting server resources and leading to denial of service (DoS) conditions. By exploiting this flaw, an attacker could degrade the performance or availability of the server.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.