Fedora 44 : valkey (2026-f6cb88e85a)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-f6cb88e85a
#

include('compat.inc');

if (description)
{
  script_id(342703);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");
  script_xref(name:"FEDORA", value:"2026-f6cb88e85a");

  script_name(english:"Fedora 44 : valkey (2026-f6cb88e85a)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-f6cb88e85a advisory.

    ## Valkey 9.0.6  -  Released Tue 01 September 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated
    client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with
    an RDMA listener (#4534)

    ### Bug Fixes

    * Fix crashes, assertion failures, and hangs when using RDMA together with IO threads by @quanyeyang
    (#3335)
    * Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by
    @quanyeyang (#4211)
    * Fix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to
    by @quanyeyang (#4253)
    * RESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration
    semantics by @tjade273 (#3973)
    * Truncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes
    after another restart by @chzhoo (#4342)
    * Fix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the
    first destination key by @tjade273 (#3971)
    * Fix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded
    module by @enjoy-binbin (#4360)
    * Always deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-
    dump-payload is now a deprecated no-op by @jjuleslasarte (#3721)
    * Fix out-of-bounds memory access when registering or receiving cluster module messages of type 255, which
    is now a valid type by @enjoy-binbin (#4410)
    * AOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a
    disabled default user by @lukepalmer (#3984)
    * Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after
    primary disconnects by @enjoy-binbin (#4395)
    * Fix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received
    next command by @foobar (#4531)
    * HGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs
    or delete fields by @ranshid (#4576)
    * Compare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a
    truncated ACL username by @madolson (#4577)
    * Restore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to
    RDMA connections by @quanyeyang (#4414)
    * Restore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA
    connections by @quanyeyang (#4452)
    * Fix atomic slot migration protocol errors with IO threads by not offloading export connection writes
    while snapshotting by @satheeshaGowda (#4104)
    * Reject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad
    migration state by @enjoy-binbin (#4229)
    * Reject RDB slot-import records with an invalid job name length, fixing an out-of-bounds read during
    startup by @quanyeyang (#4210)
    * Fix a crash when COPY ends with a bare DB token during slot migration, and block cross-DB COPY
    regardless of option order by @madolson (#4301)
    * HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword
    is missing by @cjx-zar (#4300)
    * Fix a TLS and IO threads race that could leave slot migration export jobs stuck until timeout by
    @jjuleslasarte (#4320)
    * Fix a server crash when hash field expirations are set near the maximum timestamp, for example via
    HPEXPIREAT by @ranshid (#4312)
    * Fix a stack overflow crash on TLS connections when retrying a failed write of large replies by
    @murphyjacob4 (#4307)
    * Validate cluster bus PUBLISH and MODULE packet payload lengths, preventing a remote crash from forged
    length fields by @tjade273 (#3972)
    * Fix a use-after-free crash when serving blocked clients if handling one client frees another blocked on
    the same key by @quanyeyang (#4212)
    * Fix a server panic with IO threads when pipelined commands with a wrong number of arguments reached the
    key prefetcher by @madolson (#4302)
    * Reject crafted stream RESTORE and RDB payloads with inconsistent lengths or negative field counts that
    could crash the server by @madolson (#3922)
    * Reject stream payloads with mismatched live and deleted entry counts that could make XDEL destroy live
    entries by @roshkhatri (#4381)
    * Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering once cumulative slot counters differ by more
    than 2^31 by @jzy1688 (#4459)
    * Fix atomic slot migration failures with TLS and IO threads by not offloading export connection reads
    while snapshotting by @satheeshaGowda (#4559)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-f6cb88e85a");
  script_set_attribute(attribute:"solution", value:
"Update the affected valkey package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:valkey");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'valkey-9.0.6-1.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'valkey');
}