EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-3835)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348500);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/23");

  script_cve_id(
    "CVE-2026-23340",
    "CVE-2026-43027",
    "CVE-2026-43028",
    "CVE-2026-43037",
    "CVE-2026-43038",
    "CVE-2026-43047",
    "CVE-2026-43048",
    "CVE-2026-43060",
    "CVE-2026-43139",
    "CVE-2026-43158",
    "CVE-2026-43180",
    "CVE-2026-43190",
    "CVE-2026-43194",
    "CVE-2026-43211",
    "CVE-2026-43233",
    "CVE-2026-43328",
    "CVE-2026-43336",
    "CVE-2026-43339",
    "CVE-2026-43427",
    "CVE-2026-43450",
    "CVE-2026-43452",
    "CVE-2026-43466",
    "CVE-2026-43493",
    "CVE-2026-43499",
    "CVE-2026-45840",
    "CVE-2026-45843",
    "CVE-2026-45852",
    "CVE-2026-45970",
    "CVE-2026-46006",
    "CVE-2026-46021",
    "CVE-2026-46023",
    "CVE-2026-46033",
    "CVE-2026-46043",
    "CVE-2026-46052",
    "CVE-2026-46133",
    "CVE-2026-46209",
    "CVE-2026-46227",
    "CVE-2026-46259",
    "CVE-2026-46294",
    "CVE-2026-46331",
    "CVE-2026-52923",
    "CVE-2026-53075",
    "CVE-2026-53133",
    "CVE-2026-53163",
    "CVE-2026-53176",
    "CVE-2026-53194"
  );

  script_name(english:"EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-3835)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued(CVE-2026-53163)

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls(CVE-2026-53075)

    RDMA/umem: Fix truncation for block sizes = 4G(CVE-2026-53133)

    USB: serial: kl5kusb105: fix bulk-out buffer overflow(CVE-2026-53194)

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN(CVE-2026-53176)

    ipc: limit next_id allocation to the valid ID range(CVE-2026-52923)

    net/sched: fix pedit partial COW leading to page cache corruption(CVE-2026-46331)

    (CVE-2026-43047)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-46294)

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down(CVE-2026-45970)

    RDMA/rxe: Fix double free in rxe_srq_from_init(CVE-2026-45852)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46259)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-45840)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-43339)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43190)

    RDMA/rxe: Reject unknown opcodes before ICRC processing(CVE-2026-46133)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-46227)

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv(CVE-2026-46043)

    slip: bound decode() reads against the compressed packet length(CVE-2026-45843)

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()(CVE-2026-46209)

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery(CVE-2026-43466)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46033)

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope(CVE-2026-43336)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46023)

    ceph: only d_add() negative dentries when they are unhashed(CVE-2026-46052)

    usb: class: cdc-wdm: fix reordering issue in read code path(CVE-2026-43427)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46021)

    (CVE-2026-46006)

    (CVE-2026-43060)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-43139)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    ip6_tunnel: clear skb2-cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43328)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3835
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?84d6130c");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46294");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "bpftool-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-abi-stablelists-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-libs-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "kernel-tools-libs-devel-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "perf-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10",
  "python3-perf-4.19.90-vhulk2211.3.0.h2188.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
}