EulerOS 2.0 SP13 : dracut (EulerOS-SA-2026-4043)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364886);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id("CVE-2026-6893", "CVE-2026-16445");

  script_name(english:"EulerOS 2.0 SP13 : dracut (EulerOS-SA-2026-4043)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by
    providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious
    hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written
    into temporary shell scripts without proper escaping, leading to command injection. This allows the
    attacker to achieve root code execution within the initramfs, potentially compromising the system's boot
    and network behavior.(CVE-2026-6893)

    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by
    providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to
    a system using dracut's NetworkManager-based initrd network module. These options are improperly handled
    and written into a temporary shell script without proper escaping, leading to command injection. This
    allows the attacker to achieve root code execution within the initramfs during system
    boot.(CVE-2026-16445)

Tenable has extracted the preceding description block directly from the EulerOS dracut security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-4043
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b93ec9a");
  script_set_attribute(attribute:"solution", value:
"Update the affected dracut packages.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6893");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-caps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-config-generic");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-config-rescue");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-live");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-network");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-squash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:dracut-tools");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(13)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "dracut-055-9.h4.eulerosv2r13",
  "dracut-caps-055-9.h4.eulerosv2r13",
  "dracut-config-generic-055-9.h4.eulerosv2r13",
  "dracut-config-rescue-055-9.h4.eulerosv2r13",
  "dracut-live-055-9.h4.eulerosv2r13",
  "dracut-network-055-9.h4.eulerosv2r13",
  "dracut-squash-055-9.h4.eulerosv2r13",
  "dracut-tools-055-9.h4.eulerosv2r13"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"13", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dracut");
}