Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-142)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALASDOCKER-2026-142.
##

include('compat.inc');

if (description)
{
  script_id(351054);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/29");

  script_cve_id(
    "CVE-2026-15789",
    "CVE-2026-15791",
    "CVE-2026-15792",
    "CVE-2026-15793",
    "CVE-2026-17106",
    "CVE-2026-47262",
    "CVE-2026-56855",
    "CVE-2026-61711",
    "CVE-2026-61712",
    "CVE-2026-75593",
    "CVE-2026-78662"
  );

  script_name(english:"Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-142)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2DOCKER-2026-142 advisory.

    A custom client can produce such an upload request to the BuildKit daemon that files can escape from the
    BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit
    control API to issue builds, e.g., bypass authentication, etc. (CVE-2026-15789)

    A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp
    directory. The action that can normally be used to delete files inside the build container rootfs can
    escape into the real host temp directory. (CVE-2026-15791)

    A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing
    with a panic. (CVE-2026-15792)

    BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when
    checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation
    on the host. (CVE-2026-15793)

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the
    ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive
    can create or overwrite files outside the intended destination. (CVE-2026-17106)

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would
    deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled
    explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of
    buffering and blocking. (CVE-2026-56855)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a
    crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode
    without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for
    the build container even though Linux capabilities remained restricted. This issue is fixed in version
    0.31.1. (CVE-2026-61711)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files
    without an upper bound while resolving a username to a user identifier or group identifier in
    executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide
    oversized files that exhausted memory during user resolution and caused out-of-memory termination of the
    buildkitd process. This issue is fixed in version 0.31.1. (CVE-2026-61712)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
    repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit
    daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid
    permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is
    fixed in version 0.31.2. (CVE-2026-75593)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious
    peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an
    atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every
    packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2DOCKER-2026-142.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15789.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15791.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15792.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15793.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-17106.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-47262.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56855.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-61711.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-61712.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-75593.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-78662.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update runfinch-finch' or
  or 'yum update --advisory ALAS2DOCKER-2026-142' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-15793");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:runfinch-finch");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var REPOS_FOUND = TRUE;
var extras_list = get_kb_item("Host/AmazonLinux/extras_label_list");
if (isnull(extras_list)) REPOS_FOUND = FALSE;
var repository = '"amzn2extra-docker"';
if (REPOS_FOUND && (repository >!< extras_list)) exit(0, AFFECTED_REPO_NOT_ENABLED);

var pkgs = [
    {'reference':'runfinch-finch-1.19.0-1.amzn2.0.1', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runfinch-finch-1.19.0-1.amzn2.0.1', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = rpm_report_get();
  if (!REPOS_FOUND) extra = rpm_report_get() + report_repo_caveat();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "runfinch-finch");
}