EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-3684)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347200);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id(
    "CVE-2026-31662",
    "CVE-2026-43093",
    "CVE-2026-43139",
    "CVE-2026-43158",
    "CVE-2026-43190",
    "CVE-2026-43194",
    "CVE-2026-43339",
    "CVE-2026-43450",
    "CVE-2026-43452",
    "CVE-2026-43499",
    "CVE-2026-45840",
    "CVE-2026-45843",
    "CVE-2026-45852",
    "CVE-2026-45856",
    "CVE-2026-46021",
    "CVE-2026-46023",
    "CVE-2026-46033",
    "CVE-2026-46052",
    "CVE-2026-46133",
    "CVE-2026-46177",
    "CVE-2026-46189",
    "CVE-2026-46209",
    "CVE-2026-46227",
    "CVE-2026-46259",
    "CVE-2026-46294",
    "CVE-2026-46320",
    "CVE-2026-46321",
    "CVE-2026-46322",
    "CVE-2026-46331",
    "CVE-2026-52923",
    "CVE-2026-53163",
    "CVE-2026-53176",
    "CVE-2026-53194"
  );

  script_name(english:"EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-3684)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued(CVE-2026-53163)

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN(CVE-2026-53176)

    USB: serial: kl5kusb105: fix bulk-out buffer overflow(CVE-2026-53194)

    ipc: limit next_id allocation to the valid ID range(CVE-2026-52923)

    tun: free page on build_skb failure in tun_xdp_one()(CVE-2026-46322)

    tun: free page on short-frame rejection in tun_xdp_one()(CVE-2026-46321)

    tap: free page on error paths in tap_get_user_xdp()(CVE-2026-46320)

    net/sched: fix pedit partial COW leading to page cache corruption(CVE-2026-46331)

    ipmi: Add limits to event and receive message requests(CVE-2026-46177)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-46294)

    xsk: tighten UMEM headroom validation to account for tailroom and min frame(CVE-2026-43093)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46259)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    RDMA/rxe: Reject unknown opcodes before ICRC processing(CVE-2026-46133)

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()(CVE-2026-46209)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-46227)

    RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path(CVE-2026-46189)

    RDMA/rxe: Fix double free in rxe_srq_from_init(CVE-2026-45852)

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send(CVE-2026-45856)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46021)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46023)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46033)

    ceph: only d_add() negative dentries when they are unhashed(CVE-2026-46052)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-45840)

    slip: bound decode() reads against the compressed packet length(CVE-2026-45843)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43190)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-43339)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-43139)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3684
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac81fd93");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46294");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(10)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "bpftool-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "kernel-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "kernel-abi-stablelists-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "kernel-tools-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "kernel-tools-libs-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "kernel-tools-libs-devel-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "perf-4.18.0-147.5.2.19.h2028.eulerosv2r10",
  "python3-perf-4.18.0-147.5.2.19.h2028.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"10", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
}