Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3140)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3140.
##

include('compat.inc');

if (description)
{
  script_id(351079);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/29");

  script_cve_id(
    "CVE-2026-15789",
    "CVE-2026-15791",
    "CVE-2026-15792",
    "CVE-2026-15793",
    "CVE-2026-17106",
    "CVE-2026-47262",
    "CVE-2026-56855",
    "CVE-2026-61711",
    "CVE-2026-61712",
    "CVE-2026-75593",
    "CVE-2026-78662"
  );

  script_name(english:"Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3140)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3140 advisory.

    A custom client can produce such an upload request to the BuildKit daemon that files can escape from the
    BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit
    control API to issue builds, e.g., bypass authentication, etc. (CVE-2026-15789)

    A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp
    directory. The action that can normally be used to delete files inside the build container rootfs can
    escape into the real host temp directory. (CVE-2026-15791)

    A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing
    with a panic. (CVE-2026-15792)

    BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when
    checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation
    on the host. (CVE-2026-15793)

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the
    ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive
    can create or overwrite files outside the intended destination. (CVE-2026-17106)

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would
    deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled
    explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of
    buffering and blocking. (CVE-2026-56855)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a
    crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode
    without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for
    the build container even though Linux capabilities remained restricted. This issue is fixed in version
    0.31.1. (CVE-2026-61711)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files
    without an upper bound while resolving a username to a user identifier or group identifier in
    executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide
    oversized files that exhausted memory during user resolution and caused out-of-memory termination of the
    buildkitd process. This issue is fixed in version 0.31.1. (CVE-2026-61712)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit
    daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid
    permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is
    fixed in version 0.31.2. (CVE-2026-75593)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious
    peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an
    atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every
    packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3140.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15789.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15791.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15792.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15793.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-17106.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-47262.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56855.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-61711.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-61712.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-75593.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-78662.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update runfinch-finch --releasever 2023.12.20260928' or
  or 'dnf update --advisory ALAS2023-2026-3140 --releasever 2023.12.20260928' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-15793");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:runfinch-finch");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'runfinch-finch-1.19.0-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runfinch-finch-1.19.0-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "runfinch-finch");
}