Amazon Linux 2 : amazon-efs-utils (ALAS-2026-4069)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-4069.
##

include('compat.inc');

if (description)
{
  script_id(377924);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/09");

  script_cve_id(
    "CVE-2026-16317",
    "CVE-2026-93599",
    "CVE-2026-93600",
    "CVE-2026-93601",
    "CVE-2026-111943"
  );
  script_xref(name:"IAVB", value:"2026-B-0304");

  script_name(english:"Amazon Linux 2 : amazon-efs-utils (ALAS-2026-4069)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of amazon-efs-utils installed on the remote host is prior to 3.3.5-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-4069 advisory.

    Due to security concerns regarding a small set of intermediate certificates issued by a specific
    Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by
    the affected intermediate certificates. This would prevent possible future misuse of certificate issued by
    the affected intermediate certificates.

    Amazon Linux golang-based packages are being rebuilt with the fixed crypto/x509 package described in
    CVE-2026-111943 as a defense-in-depth measure against the eMudhra intermediate CA certificates with weak
    private keys.

    By default, Go programs on Amazon Linux use the system-wide certificate authority (CA) store. Therefore,
    the primary fix for this issue is the ca-certificates update that removes the root CA certificates that
    signed the affected intermediates. Customers should ensure that update is installed:
    https://explore.alas.aws.amazon.com/CVE-2026-113470.html (CVE-2026-111943)

    Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active
    man-in-the-middle to silently discard individual application data records without either endpoint
    detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS
    1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the
    additional authenticated data rather than using the actual wire byte, so the outer content_type is not
    covered by the authentication tag.



    This enables selective suppression of application data. In HTTP pipelining scenarios, dropping a TLS
    record containing an HTTP request can cause request/response desynchronization, where subsequent responses
    are delivered to the wrong requests. In write-heavy workloads, a dropped record containing a write request
    can result in undetectable data loss when the client interprets a subsequent success response as
    confirmation of the dropped write.



    All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC
    connections are not affected.



    We recommend you upgrade s2n-tls to version v1.7.6 (CVE-2026-16317)

    rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable
    panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose
    content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the
    empty slice and the subsequent index operation panics (subtract-with-overflow in debug, index-out-of-
    bounds in release). The condition is reachable through the public API
    BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such
    an onlySomeReasons value. Exploitation requires an application that explicitly opts in to CRL revocation
    checking by passing RevocationOptions to verify_for_usage() and that parses CRL bytes obtained from a
    source the attacker can influence; the default rustls configuration, which does not use RevocationOptions,
    is unaffected. A crafted CRL causes a denial of service via the panic. Fixed in 0.103.13 and
    0.104.0-alpha.7. (CVE-2026-93599)

    rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before
    0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be
    accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued
    certificates, the flaw is only reachable after successful signature verification and requires a misissued
    certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints
    are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints
    unconditionally. (CVE-2026-93600)

    rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and
    0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a
    wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a
    certificate for *.example.com, which could feasibly assert reject.example.com -- a name outside the
    permitted subtree. Because name constraints are restrictions applied to otherwise properly issued
    certificates, the issue is only reachable after signature verification succeeds and requires a misissued
    wildcard certificate to exploit. (CVE-2026-93601)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-4069.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-111943.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-16317.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93599.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93600.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93601.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update amazon-efs-utils' or
  or 'yum update --advisory ALAS2-2026-4069' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-111943");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-93599");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:amazon-efs-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'amazon-efs-utils-3.3.5-1.amzn2', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'amazon-efs-utils-3.3.5-1.amzn2', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "amazon-efs-utils");
}