NewStart CGSL MAIN 6.02 : cryptsetup Vulnerability (NS-SA-2021-0087)

##
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2021-0087. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(147249);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/03/10");

  script_cve_id("CVE-2020-14382");

  script_name(english:"NewStart CGSL MAIN 6.02 : cryptsetup Vulnerability (NS-SA-2021-0087)");

  script_set_attribute(attribute:"synopsis", value:
"The remote machine is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 6.02, has cryptsetup packages installed that are affected by a
vulnerability:

  - A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format
    validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container.
    The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function
    hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for
    possible overflow on memory allocation used for intervals array (see statement intervals =
    malloc(first_backup * sizeof(*intervals));). Due to the bug, library can be *tricked* to expect such
    allocation was successful but for far less memory then originally expected. Later it may read data FROM
    image crafted by an attacker and actually write such data BEYOND allocated memory. (CVE-2020-14382)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2021-0087");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL cryptsetup packages. Note that updated packages may not be available yet. Please contact ZTE
for more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-14382");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/03/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2021/03/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('audit.inc');
include('global_settings.inc');
include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (release !~ "CGSL MAIN 6.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

flag = 0;

pkgs = {
  'CGSL MAIN 6.02': [
    'cryptsetup-2.3.3-2.el8',
    'cryptsetup-debuginfo-2.3.3-2.el8',
    'cryptsetup-debugsource-2.3.3-2.el8',
    'cryptsetup-devel-2.3.3-2.el8',
    'cryptsetup-libs-2.3.3-2.el8',
    'cryptsetup-libs-debuginfo-2.3.3-2.el8',
    'cryptsetup-reencrypt-2.3.3-2.el8',
    'cryptsetup-reencrypt-debuginfo-2.3.3-2.el8',
    'integritysetup-2.3.3-2.el8',
    'integritysetup-debuginfo-2.3.3-2.el8',
    'veritysetup-2.3.3-2.el8',
    'veritysetup-debuginfo-2.3.3-2.el8'
  ]
};
pkg_list = pkgs[release];

foreach (pkg in pkg_list)
  if (rpm_check(release:'ZTE ' + release, reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cryptsetup');
}