NewStart CGSL MAIN 7.02 : kernel Multiple Vulnerabilities (NS-SA-2025-0253)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2025-0253. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271294);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/24");

  script_cve_id(
    "CVE-2024-36971",
    "CVE-2024-53122",
    "CVE-2024-53141",
    "CVE-2024-53197",
    "CVE-2024-57900",
    "CVE-2025-21927",
    "CVE-2025-21934"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/08/28");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/04/30");

  script_name(english:"NewStart CGSL MAIN 7.02 : kernel Multiple Vulnerabilities (NS-SA-2025-0253)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has kernel packages installed that are affected by multiple
vulnerabilities:

  - In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when
    rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus,
    put_device() should be used rather than kfree(). Add mport->net = NULL; to avoid a use after free issue.
    (CVE-2025-21934)

  - In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race
    __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to
    possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).
    Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the
    wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the
    three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check
    against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various
    callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the
    blamed commit, using UDP sockets. (CVE-2024-36971)

  - In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in
    mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are
    included into the subflow list before starting the 3whs. A racing recvmsg() spooling data received on an
    already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows,
    potentially hitting a divide by zero error on the newly created ones. Explicitly check that the subflow is
    in a suitable state before invoking tcp_cleanup_rbuf(). (CVE-2024-53122)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range
    check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the
    values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but
    this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and
    remove unnecessary range checks. (CVE-2024-53141)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-
    bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that
    exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-
    of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2025-0253");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-36971");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-41071");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-53122");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-53141");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-53197");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2024-57900");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-21927");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-21934");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL kernel packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21934");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:Zeal-kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-debug-modules-internal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-kasan-modules-internal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:kernel-modules-internal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:system-enhance-cgslv7.25");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'Zeal-kernel-tools-6.6.25-2.1.zncgsl7.1748',
    'kernel-6.6.25-2.1.zncgsl7.1748',
    'kernel-core-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-core-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-devel-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-modules-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-modules-extra-6.6.25-2.1.zncgsl7.1748',
    'kernel-debug-modules-internal-6.6.25-2.1.zncgsl7.1748',
    'kernel-devel-6.6.25-2.1.zncgsl7.1748',
    'kernel-headers-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-core-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-devel-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-modules-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-modules-extra-6.6.25-2.1.zncgsl7.1748',
    'kernel-kasan-modules-internal-6.6.25-2.1.zncgsl7.1748',
    'kernel-modules-6.6.25-2.1.zncgsl7.1748',
    'kernel-modules-extra-6.6.25-2.1.zncgsl7.1748',
    'kernel-modules-internal-6.6.25-2.1.zncgsl7.1748',
    'system-enhance-cgslv7.25-6.6.25-2.1.zncgsl7.1748'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}