Fedora 45 : valkey (2026-3e6f9d599a)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-3e6f9d599a
#

include('compat.inc');

if (description)
{
  script_id(344883);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");
  script_xref(name:"FEDORA", value:"2026-3e6f9d599a");

  script_name(english:"Fedora 45 : valkey (2026-3e6f9d599a)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-3e6f9d599a advisory.

    ## Valkey 9.1.2  -  Released Mon 31 August 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated
    client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with
    an RDMA listener (#4534)
    * GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a
    process-global script debugger command table that cached a raw pointer to a freed interpreter and was
    never invalidated (#4574)

    ### Bug Fixes

    * Fix a double-free crash when a module timer callback stops its own timer with `ValkeyModule_StopTimer`
    by @quanyeyang (#4211)
    * Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to, which could
    desync client libraries by @quanyeyang (#4253)
    * Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes;
    `sanitize-dump-payload` and its ACL flags become no-ops by @jjuleslasarte (#3721)
    * Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads by
    @quanyeyang (#3611)
    * RESET now clears the `CLIENT IMPORT-SOURCE` flag, so reused pooled connections return to normal
    expiration semantics by @tjade273 (#3973)
    * Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes
    after a later restart by @chzhoo (#4342)
    * Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the
    user's permitted patterns by @tjade273 (#3971)
    * Fix command log redaction leaking between commands in a MULTI transaction and missing for commands
    executed from scripts by @madolson (#4323)
    * Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded
    by @enjoy-binbin (#4360)
    * Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message
    type by @enjoy-binbin (#4410)
    * AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the
    default user is disabled by @lukepalmer (#3984)
    * Fix a client memory accounting leak on replicas that inflated the `mem_clients_normal` INFO field after
    primary disconnections by @enjoy-binbin (#4395)
    * Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered
    pipelined command by @foobar (#4531)
    * HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change
    field TTLs or delete fields by @ranshid (#4576)
    * Compare the whole TLS certificate CN during authentication, so an embedded NUL can no longer impersonate
    another ACL user by @madolson (#4577)
    * Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while
    snapshotting by @satheeshaGowda (#4104)
    * Reject invalid slot import ranges when loading an RDB, so corrupted files can no longer create bad
    migration jobs by @enjoy-binbin (#4229)
    * Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at
    startup by @quanyeyang (#4210)
    * MOVE and COPY now check ACL access to the current database, so users can no longer exfiltrate keys from
    an unauthorized DB by @cjx-zar (#4155)
    * Fix a crash on COPY with a trailing DB option during slot migration, and block cross-DB COPY regardless
    of option order by @madolson (#4301)
    * Fix a server panic when pipelined commands with invalid arity reach the key prefetcher with I/O threads
    enabled by @madolson (#4302)
    * HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword
    is missing by @cjx-zar (#4300)
    * Fix a race between TLS I/O-thread writes and reads that could leave slot migration export jobs stuck
    until timeout by @jjuleslasarte (#4320)
    * Fix a signed overflow that let very large hash field expiration times (e.g. via HPEXPIREAT) crash the
    server by @ranshid (#4312)
    * Fix a frozen monotonic clock on hosts with unsynchronized TSC that stopped background tasks and key
    expiration by @quanyeyang (#4346)
    * Fix a stack overflow crash when retrying a failed TLS write with a large reply by @murphyjacob4 (#4307)
    * Fix the `--check-system` clocksource check to skip hosts using a hardware clock and suggest only
    actually available clocksources by @quanyeyang (#4272)
    * Fix an assertion failure with I/O threads when a blocked client's pending command was processed again
    before unblocking by @quanyeyang (#4376)
    * Sentinel no longer loads the built-in Lua scripting engine, removing a spurious warning at startup by
    @enjoy-binbin (#4327)
    * Validate channel, message, and module payload lengths in cluster bus packets, preventing forged packets
    from crashing nodes by @tjade273 (#3972)
    * Harden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on
    later commands by @madolson (#3922)
    * Reject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying
    unaccounted entries by @roshkhatri (#4381)
    * Skip unnecessary post-read processing with I/O threads on socket and TLS connections, restoring small-
    payload throughput by @quanyeyang (#4401)
    * Fix a use-after-free crash when serving clients blocked on the same key if one client is freed during
    processing by @quanyeyang (#4212)
    * Avoid an unneeded client lookup per write completion with I/O threads on socket and TLS connections,
    improving pipelined throughput by @dgershko (#4440)
    * Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering when slot counters differ by more than 2^31 by
    @jzy1688 (#4459)
    * Fix slot migration failures with I/O threads and TLS by keeping the export job's ACK reads on the main
    thread while snapshotting by @satheeshaGowda (#4559)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e6f9d599a");
  script_set_attribute(attribute:"solution", value:
"Update the affected valkey package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:45");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:valkey");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^45([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 45', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '45',
    'pkgs': [
      {'reference':'valkey-9.1.2-1.fc45', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'valkey');
}