Amazon Linux 2023 : cuda-runtime-13 (ALAS2023NVIDIA-2025-167)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023NVIDIA-2025-167.
##

include('compat.inc');

if (description)
{
  script_id(270423);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2025-23248",
    "CVE-2025-23255",
    "CVE-2025-23271",
    "CVE-2025-23273",
    "CVE-2025-23274",
    "CVE-2025-23275",
    "CVE-2025-23308",
    "CVE-2025-23338",
    "CVE-2025-23339",
    "CVE-2025-23340",
    "CVE-2025-23346"
  );
  script_xref(name:"IAVB", value:"2025-B-0160-S");

  script_name(english:"Amazon Linux 2023 : cuda-runtime-13 (ALAS2023NVIDIA-2025-167)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-167 advisory.

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may
    cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this
    vulnerability may lead to a partial denial of service. (CVE-2025-23248)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may
    cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this
    vulnerability may lead to a partial denial of service. (CVE-2025-23255)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may
    cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this
    vulnerability may lead to a partial denial of service. (CVE-2025-23271)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user
    may cause a divide by zero error by submitting a specially crafted JPEG file. A successful exploit of this
    vulnerability may lead to denial of service. (CVE-2025-23273)

    NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by
    providing a maliciously crafted input image with dimensions that cause integer overflows in array index
    calculations. A successful exploit of this vulnerability may lead to denial of service. (CVE-2025-23274)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user
    may cause a GPU out-of-bounds write by providing certain image dimensions.  A successful exploit of this
    vulnerability may lead to denial of service and information disclosure. (CVE-2025-23275)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a
    heap-based buffer overflow by getting the user to run nvdisasm on a malicious ELF file. A successful
    exploit of this vulnerability may lead to arbitrary code execution at the privilege level of the user
    running nvdisasm. (CVE-2025-23308)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-
    of-bounds write by running nvdisasm on a malicious ELF file. A successful exploit of this vulnerability
    may lead to denial of service. (CVE-2025-23338)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a
    stack-based buffer overflow by getting the user to run cuobjdump on a malicious ELF file. A successful
    exploit of this vulnerability may lead to arbitrary code execution at the privilege level of the user
    runningcuobjdump. (CVE-2025-23339)

    NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may
    cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this
    vulnerability may lead to a partial denial of service. (CVE-2025-23340)

    NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL
    pointer dereference.  A successful exploit of this vulnerability may lead to a limited denial of service.
    (CVE-2025-23346)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023NVIDIA-2025-167.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23248.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23255.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23271.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23273.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23274.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23275.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23308.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23338.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23339.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23340.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-23346.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update cuda-runtime-13-0 --releasever latest' or
  or 'dnf update --advisory ALAS2023NVIDIA-2025-167 --releasever latest' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-23339");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:cuda-runtime-13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'cuda-runtime-13-0-13.0.0-1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cuda-runtime-13");
}