MiracleLinux 8 : kernel-4.18.0-553.141.2.el8_10 (AXSA:2026-1311:50)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2026-1311:50.
##

include('compat.inc');

if (description)
{
  script_id(328693);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/21");

  script_cve_id(
    "CVE-2025-10263",
    "CVE-2026-43112",
    "CVE-2026-43198",
    "CVE-2026-43450",
    "CVE-2026-46209",
    "CVE-2026-46227",
    "CVE-2026-46259"
  );

  script_name(english:"MiracleLinux 8 : kernel-4.18.0-553.141.2.el8_10 (AXSA:2026-1311:50)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2026-1311:50 advisory.

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
      * kernel: netfilter: nfnetlink_cthelper: fix OOB read in
    nfnl_cthelper_dump_table() (CVE-2026-43450)
      * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
    SCTP_SENDALL (CVE-2026-46227)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in
    drm_gem_fb_init_with_funcs() (CVE-2026-46209)
      * kernel: procfs: fix missing RCU protection when reading real_parent in
    do_task_stat() (CVE-2026-46259)
    * kernel: Arm Processors: Privilege escalation or information disclosure via
    writes to higher exception level resources (CVE-2025-10263)
    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
    (CVE-2026-43112)
    CVE-2025-10263
    Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1,
    Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2,
    Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 &
    A76A may allow writes to resources owned by a higher exception level.
    CVE-2026-43198
    In the Linux kernel, the following vulnerability has been resolved: tcp: fix
    potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after
    the call to tcp_v4_syn_recv_sock() is done too late. After
    tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table
    and other cpus might use it. Since newinet->pinet6 is still pointing to the
    listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic
    code in tcp_v6_mapped_child_init() and call this new helper from
    tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of
    one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct
    context.
    CVE-2026-43450
    In the Linux kernel, the following vulnerability has been resolved: netfilter:
    nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
    nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the
    for loop body. When the last helper saved in cb->args[1] is deleted between
    dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never
    cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the
    'goto restart' jumps back into the loop body bypassing the bounds check, causing
    an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto
    restart' block was meant to re-traverse the current bucket when last is no
    longer found, but it was placed after the for loop instead of inside it. Move
    the block into the for loop body so that the restart only occurs while
    cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in
    nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by
    task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0
    netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0
    __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0
    Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700
    nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60
    nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0
    CVE-2026-46209
    In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix
    inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
    drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain
    integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
    unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the
    ioctl-level framebuffer_check() in drm_framebuffer.c uses
    drm_format_info_plane_width/height() which round up dimensions via
    DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check
    for certain pixel format and dimension combinations. For example, with NV12
    (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees
    height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX
    as an unsigned int, causing min_size to overflow and wrap back to a small value.
    A tiny GEM object therefore passes the size guard, yet when the GPU accesses the
    chroma plane it will read or write memory beyond the object's bounds. Fix by
    replacing the open-coded divisions with drm_format_info_plane_width() and
    drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the
    calculation already used in framebuffer_check().
    CVE-2026-46227
    In the Linux kernel, the following vulnerability has been resolved: sctp:
    revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The
    SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with
    list_for_each_entry_safe(), which caches the next entry in @tmp before the loop
    body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock
    inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can
    SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new
    endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to
    newep->asocs), and optionally close the new socket which frees the association
    via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that
    association, processed in softirq while the lock is dropped.
    sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the
    sk != asoc->base.sk and asoc->base.dead checks, but nothing revalidates
    @tmp. After a successful return, the iterator advances to the stale @tmp,
    yielding either a use-after-free (if the peeled socket was closed) or a
    list-walk onto the new endpoint's list head (type confusion of &newep->asocs as
    a struct sctp_association *). Both are reachable from CapEff=0; the
    type-confusion path gives controlled indirect call via the
    outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after
    sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that
    point: the only callers that list_del an association from ep->asocs are
    sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate()
    (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the
    lock before any successful return; a tripped check propagates as err < 0 and the
    loop bails before the re-derive. The SCTP_ABORT path in
    sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before
    sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by
    list_for_each_entry_safe() still covers the lock-held free that ba59fb027307
    (sctp: walk the list of asoc safely) was added for.
    CVE-2026-46259
    In the Linux kernel, the following vulnerability has been resolved: procfs: fix
    missing RCU protection when reading real_parent in do_task_stat() When reading
    /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU
    protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var =
    task->real_parent release_task call_rcu(delayed_put_task_struct)
    task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent!
    task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead
    of task_tgid_nr_ns() to add proper RCU protection for accessing
    task->real_parent.
    CVE-2026-43112
    In the Linux kernel, the following vulnerability has been resolved:
    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When
    cifs_sanitize_prepath is called with an empty string or a string containing only
    delimiters (e.g., /), the current logic attempts to check *(cursor2 - 1)
    before cursor2 has advanced. This results in an out-of-bounds read. This patch
    adds an early exit check after stripping prepended delimiters. If no path
    content remains, the function returns NULL. The bug was identified via manual
    audit and verified using a standalone test case compiled with AddressSanitizer,
    which triggered a SEGV on affected inputs.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/24136");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43450");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-cross-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:8");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 8.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'bpftool-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-abi-stablelists-4.18.0-553.141.2.el8_10', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-core-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-cross-headers-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-core-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-extra-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-extra-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-devel-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-perf-4.18.0-553.141.2.el8_10', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');
}