Oracle Linux 9 : dracut (ELSA-2026-26533)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2026-26533.
##

include('compat.inc');

if (description)
{
  script_id(322994);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2026-6893");

  script_name(english:"Oracle Linux 9 : dracut (ELSA-2026-26533)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the
ELSA-2026-26533 advisory.

    [057-115.git20260527.0.1]
    - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the
    kernel. [Orabug: 38705580]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]
    ([email protected])
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [057-115.git20260527]
    - build: rebuild without an obsoleted patch

    [057-115.git20260514]
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script
      Related: RHEL-170857

    [057-113.git20260502]
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(base): replace eval with safe variable indirection in
      Resolves: RHEL-170857

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2026-26533.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6893");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:9:8:baseos_patch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-caps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-config-generic");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-config-rescue");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-live");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-network");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-squash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-tools");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_product)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
if (! preg(pattern:"^9([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Oracle Linux 9.x', 'Oracle Linux ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var constraints = [
  {
    'release': '9',
    'pkgs': [
      {'reference':'dracut-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-caps-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-generic-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-rescue-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-live-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-network-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-squash-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-tools-057-115.git20260527.0.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-caps-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-generic-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-rescue-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-live-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-network-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-squash-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-tools-057-115.git20260527.0.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dracut / dracut-caps / dracut-config-generic / etc');
}