Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-915)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2025-915.
##

include('compat.inc');

if (description)
{
  script_id(233707);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2024-26982",
    "CVE-2024-53166",
    "CVE-2024-56549",
    "CVE-2024-57979",
    "CVE-2025-21700",
    "CVE-2025-21701",
    "CVE-2025-21726",
    "CVE-2025-21727",
    "CVE-2025-21731",
    "CVE-2025-21753",
    "CVE-2025-21756",
    "CVE-2025-21758",
    "CVE-2025-21760",
    "CVE-2025-21761",
    "CVE-2025-21762",
    "CVE-2025-21763",
    "CVE-2025-21764",
    "CVE-2025-21791",
    "CVE-2025-21796",
    "CVE-2025-21913",
    "CVE-2025-21919",
    "CVE-2025-21920",
    "CVE-2025-21926",
    "CVE-2025-21928",
    "CVE-2025-21938",
    "CVE-2025-21948"
  );

  script_name(english:"Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-915)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-915 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix bfqq uaf in bfq_limit_depth() (CVE-2024-53166)

    In the Linux kernel, the following vulnerability has been resolved:

    cachefiles: Fix NULL pointer dereference in object->file (CVE-2024-56549)

    In the Linux kernel, the following vulnerability has been resolved:

    pps: Fix a use-after-free (CVE-2024-57979)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: Disallow replacing of child qdisc from one parent to another (CVE-2025-21700)

    In the Linux kernel, the following vulnerability has been resolved:

    net: avoid race between device unregistration and ethnl ops (CVE-2025-21701)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: avoid UAF for reorder_work (CVE-2025-21726)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: fix UAF in padata_reorder (CVE-2025-21727)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: don't allow reconnect after disconnect (CVE-2025-21731)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix use-after-free when attempting to join an aborted transaction (CVE-2025-21753)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Keep the binding until socket destruction (CVE-2025-21756)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: mcast: add RCU protection to mld_newpack() (CVE-2025-21758)

    In the Linux kernel, the following vulnerability has been resolved:

    ndisc: extend RCU protection in ndisc_send_skb() (CVE-2025-21760)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761)

    In the Linux kernel, the following vulnerability has been resolved:

    arp: use RCU protection in arp_xmit() (CVE-2025-21762)

    In the Linux kernel, the following vulnerability has been resolved:

    neighbour: use RCU protection in __neigh_notify() (CVE-2025-21763)

    In the Linux kernel, the following vulnerability has been resolved:

    ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)

    In the Linux kernel, the following vulnerability has been resolved:

    vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (CVE-2025-21913)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)

    In the Linux kernel, the following vulnerability has been resolved:

    vlan: enforce underlying device type (CVE-2025-21920)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (CVE-2025-21938)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: appleir: Fix potential NULL dereference at raw event handle (CVE-2025-21948)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/AL2023/ALAS-2025-915.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-26982.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-53166.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-56549.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2024-57979.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21700.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21701.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21726.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21727.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21731.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21753.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21756.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21758.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21760.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21761.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21762.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21763.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21764.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21791.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21796.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21913.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21919.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21920.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21926.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21928.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21938.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2025-21948.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update kernel --releasever 2023.7.20250331' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21928");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/03/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-libbpf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-libbpf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-libbpf-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-libbpf-static");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-livepatch-6.1.131-143.221");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-modules-extra-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "kpatch.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm.inc");
include("hotfixes.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (get_one_kb_item("Host/kpatch/kernel-cves"))
{
  var cve_list = make_list("CVE-2024-26982", "CVE-2024-53166", "CVE-2024-56549", "CVE-2024-57979", "CVE-2025-21700", "CVE-2025-21701", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21731", "CVE-2025-21753", "CVE-2025-21756", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21764", "CVE-2025-21791", "CVE-2025-21796", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21920", "CVE-2025-21926", "CVE-2025-21928", "CVE-2025-21938", "CVE-2025-21948");
  if (hotfix_cves_check(cve_list))
  {
    audit(AUDIT_PATCH_INSTALLED, "kpatch hotfix for ALAS2023-2025-915");
  }
  else
  {
    __rpm_report = hotfix_reporting_text();
  }
}

var pkgs = [
    {'reference':'bpftool-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-6.1.'},
    {'reference':'bpftool-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-6.1.'},
    {'reference':'bpftool-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-debuginfo-6.1.'},
    {'reference':'bpftool-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-debuginfo-6.1.'},
    {'reference':'kernel-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-6.1.'},
    {'reference':'kernel-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-6.1.'},
    {'reference':'kernel-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-6.1.'},
    {'reference':'kernel-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-6.1.'},
    {'reference':'kernel-debuginfo-common-aarch64-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-common-aarch64-6.1.'},
    {'reference':'kernel-debuginfo-common-x86_64-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-common-x86_64-6.1.'},
    {'reference':'kernel-devel-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-devel-6.1.'},
    {'reference':'kernel-devel-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-devel-6.1.'},
    {'reference':'kernel-headers-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-6.1.'},
    {'reference':'kernel-headers-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-6.1.'},
    {'reference':'kernel-libbpf-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-6.1.'},
    {'reference':'kernel-libbpf-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-6.1.'},
    {'reference':'kernel-libbpf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-debuginfo-6.1.'},
    {'reference':'kernel-libbpf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-debuginfo-6.1.'},
    {'reference':'kernel-libbpf-devel-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-devel-6.1.'},
    {'reference':'kernel-libbpf-devel-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-devel-6.1.'},
    {'reference':'kernel-libbpf-static-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-static-6.1.'},
    {'reference':'kernel-libbpf-static-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-libbpf-static-6.1.'},
    {'reference':'kernel-livepatch-6.1.131-143.221-1.0-0.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-livepatch-6.1.131-143.221-1.0-0.'},
    {'reference':'kernel-livepatch-6.1.131-143.221-1.0-0.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-livepatch-6.1.131-143.221-1.0-0.'},
    {'reference':'kernel-modules-extra-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-6.1.'},
    {'reference':'kernel-modules-extra-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-6.1.'},
    {'reference':'kernel-modules-extra-common-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-common-6.1.'},
    {'reference':'kernel-modules-extra-common-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-common-6.1.'},
    {'reference':'kernel-tools-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-6.1.'},
    {'reference':'kernel-tools-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-6.1.'},
    {'reference':'kernel-tools-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-debuginfo-6.1.'},
    {'reference':'kernel-tools-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-debuginfo-6.1.'},
    {'reference':'kernel-tools-devel-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-devel-6.1.'},
    {'reference':'kernel-tools-devel-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-devel-6.1.'},
    {'reference':'perf-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-6.1.'},
    {'reference':'perf-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-6.1.'},
    {'reference':'perf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-debuginfo-6.1.'},
    {'reference':'perf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-debuginfo-6.1.'},
    {'reference':'python3-perf-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-6.1.'},
    {'reference':'python3-perf-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-6.1.'},
    {'reference':'python3-perf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-debuginfo-6.1.'},
    {'reference':'python3-perf-debuginfo-6.1.131-143.221.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-debuginfo-6.1.'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bpftool / bpftool-debuginfo / kernel / etc");
}