EulerOS 2.0 SP11 : lxc (EulerOS-SA-2026-3084)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333476);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/08");

  script_cve_id("CVE-2026-39402");

  script_name(english:"EulerOS 2.0 SP11 : lxc (EulerOS-SA-2026-3084)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the lxc packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw
    in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces
    belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request,
    the interface name comparison can set the authorization flag based on a name match alone, even when the
    ownership, type, and link fields in that database entry belong to a different user. The vulnerable check
    sits after the goto next label handling, meaning it is reachable on lines where earlier ownership checks
    failed or were skipped. Because nothing downstream of this authorization signal re-verifies that the
    matched database line actually belongs to the caller, an unprivileged attacker with a valid lxc-usernet
    policy entry can trigger deletion of another user's OVS port on the same bridge.

    This is limited to multi-tenant environments using lxc-user-nic with OpenVSwitch bridges. The impact is
    denial of service - one tenant can repeatedly disconnect networking from containers run by another tenant
    on shared infrastructure. This is patched in version 7.0.0.(CVE-2026-39402)

Tenable has extracted the preceding description block directly from the EulerOS lxc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3084
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0d1b1880");
  script_set_attribute(attribute:"solution", value:
"Update the affected lxc packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-39402");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:lxc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:lxc-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:lxc-libs");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(11)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP11", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "lxc-4.0.3-2022031701.h19.eulerosv2r11",
  "lxc-help-4.0.3-2022031701.h19.eulerosv2r11",
  "lxc-libs-4.0.3-2022031701.h19.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"11", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "lxc");
}