EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-3744)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348044);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/23");

  script_cve_id(
    "CVE-2026-23340",
    "CVE-2026-43027",
    "CVE-2026-43028",
    "CVE-2026-43037",
    "CVE-2026-43038",
    "CVE-2026-43047",
    "CVE-2026-43048",
    "CVE-2026-43060",
    "CVE-2026-43139",
    "CVE-2026-43158",
    "CVE-2026-43180",
    "CVE-2026-43190",
    "CVE-2026-43194",
    "CVE-2026-43211",
    "CVE-2026-43233",
    "CVE-2026-43328",
    "CVE-2026-43336",
    "CVE-2026-43339",
    "CVE-2026-43427",
    "CVE-2026-43450",
    "CVE-2026-43452",
    "CVE-2026-43466",
    "CVE-2026-43493",
    "CVE-2026-43499",
    "CVE-2026-45840",
    "CVE-2026-45843",
    "CVE-2026-45852",
    "CVE-2026-45970",
    "CVE-2026-46006",
    "CVE-2026-46021",
    "CVE-2026-46023",
    "CVE-2026-46033",
    "CVE-2026-46043",
    "CVE-2026-46052",
    "CVE-2026-46133",
    "CVE-2026-46209",
    "CVE-2026-46227",
    "CVE-2026-46259",
    "CVE-2026-46294",
    "CVE-2026-46331",
    "CVE-2026-52923",
    "CVE-2026-53075",
    "CVE-2026-53133",
    "CVE-2026-53163",
    "CVE-2026-53176",
    "CVE-2026-53194"
  );

  script_name(english:"EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-3744)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued(CVE-2026-53163)

    RDMA/umem: Fix truncation for block sizes = 4G(CVE-2026-53075)

    USB: serial: kl5kusb105: fix bulk-out buffer overflow(CVE-2026-53133)

    ipc: limit next_id allocation to the valid ID range(CVE-2026-53194)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-53176)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-52923)

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down(CVE-2026-46331)

    RDMA/rxe: Fix double free in rxe_srq_from_init(CVE-2026-43047)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43048)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46294)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-45970)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-45852)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-43028)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-46259)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43027)

    RDMA/rxe: Reject unknown opcodes before ICRC processing(CVE-2026-23340)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-45840)

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv(CVE-2026-43339)

    slip: bound decode() reads against the compressed packet length(CVE-2026-43190)

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery(CVE-2026-46133)

    net: consume xmit errors of GSO frames(CVE-2026-46227)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46043)

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope(CVE-2026-45843)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46209)

    ceph: only d_add() negative dentries when they are unhashed(CVE-2026-43466)

    usb: class: cdc-wdm: fix reordering issue in read code path(CVE-2026-43194)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46033)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43336)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-46023)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-46052)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43427)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-46021)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-46006)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43060)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43139)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43233)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43450)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    ip6_tunnel: clear skb2-cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43328)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3744
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e0f115a");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46294");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(10)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "bpftool-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-abi-stablelists-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-libs-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-libs-devel-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "perf-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "python3-perf-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"10", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
}