Oracle Linux 10 : binutils (ELSA-2025-23306)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2025-23306.
##

include('compat.inc');

if (description)
{
  script_id(279467);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/03");

  script_cve_id("CVE-2025-11082", "CVE-2025-11083");
  script_xref(name:"IAVA", value:"2025-A-0890-S");

  script_name(english:"Oracle Linux 10 : binutils (ELSA-2025-23306)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in
the ELSA-2025-23306 advisory.

    - CVE-2025-11082
    - CVE-2025-11083
      Reviewed-by: David Faust <[email protected]>
      Oracle history:
      September-29-2025 David Faust <[email protected]> - 2.41-58.0.1
      - Forward-port Oracle patches to 2.41-58.
        Reviewed-by: Jose E. Marchesi <[email protected]>
      August-29-2025 Bruce McCulloch <[email protected]> - 2.41-57.0.1
      - Forward-port Oracle patches to 2.41-57.
        Reviewed-by: Jose E. Marchesi <[email protected]>
      Jun-04-2025 Bruce McCulloch <[email protected]> - 2.41-53.0.3
      - Add binutils-orabug-38018827.patch.
        - Fix ctf_dict_open clobbering errno.
        - Backport of upstream commit:
          - 14303d6295e libctf: archive, open: when opening, always set errp to
            something.
        - [Orabug: 38018827]
      - Add binutils-orabug-38018828.patch.
        - In kernel links, properly hide CTF types only if conflicting.
        - Backport of upstream commits:
          - 75e514cfa56 Revert 'libctf: fix linking of non-root-visible types'
          - 002957be18e libctf: dedup: improve hiding of conflicting types in the
            same dict
        - [Orabug: 38018828]
        Reviewed-by: Jose E. Marchesi <[email protected]>
        Reviewed-by: Nick Alcock <[email protected]>
        Reviewed-by: Elena Zannoni <[email protected]>
      May-28-2025 Vladimir Mezentsev  <[email protected]> - 2.41-53.0.2
      - Backported updates for gprofng.
        Reviewed-by: Bruce McCulloch <[email protected]>
      April-02-2025 Bruce McCulloch  <[email protected]> - 2.41-53.0.1
      - Merge Oracle patches to 2.41-53.
        Reviewed-by: Jose E. Marchesi <[email protected]>
      November-28-2024 Nick Alcock <[email protected]> - 2.41-45.0.1
      - Latest CTF changes from upstream
        - add ctf_dict_set_flag, ctf_lookup_enumerator, ctf_lookup_enumerator_next,
          ctf_arc_lookup_enumerator_next; consider enums with differing enumerators
          to be conflicting
       - add documentation to ctf-api.h
       - allow modification of ctf_opened dicts and opening of foreign-
         endian older dicts
       - looking up types by name prefers non-bitfields if possible
       - bugfixes to parent propagation, rewriting of existing dicts,
         ctf_archive_count, CU-mapped links, and dumping and linking of
         non-root-visible types.
       - fix a bunch of small leaks and one big one (on ctf_open error)
       - fix a write into freed memory after ctf_rollback and writeout
       - internal improvements to serialization, name lookup, symbol
         lookup, string handling, and more
      - explicitly disable zstd support (enabling requires addition of zstd to
        the .so scripts)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2025-23306.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-11083");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:10:1:baseos_patch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:binutils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:binutils-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:binutils-gold");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:binutils-gprofng");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_product)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
if (! preg(pattern:"^10([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Oracle Linux 10.x', 'Oracle Linux ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var constraints = [
  {
    'release': '10',
    'pkgs': [
      {'reference':'binutils-2.41-58.0.1.el10_1.2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-devel-2.41-58.0.1.el10_1.2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-gold-2.41-58.0.1.el10_1.2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-gprofng-2.41-58.0.1.el10_1.2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-2.41-58.0.1.el10_1.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-devel-2.41-58.0.1.el10_1.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-gold-2.41-58.0.1.el10_1.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'binutils-gprofng-2.41-58.0.1.el10_1.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'binutils / binutils-devel / binutils-gold / etc');
}