Oracle Linux 8 : dracut (ELSA-2026-26534)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2026-26534.
##

include('compat.inc');

if (description)
{
  script_id(321808);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/21");

  script_cve_id("CVE-2026-6893");

  script_name(english:"Oracle Linux 8 : dracut (ELSA-2026-26534)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the
ELSA-2026-26534 advisory.

    [049-244.git20260529.0.1]
    - Refactor get_ucode_file [Orabug: 36989953]
    - Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614]
    - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918]
    - Enable the code to create ifcfg file [Orabug: 33888951]
    - Skip parse iscsiroot.sh on PV VMs [Orabug: 33676753]
    - Add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs [Orabug: 33603682]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Restore 51-dracut-rescue-postinst.sh for anaconda compatibility
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Add manpage for single-dhcp [Orabug 32201686]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - Use pgrep in dhcp-multi.sh to make efficient and error free [Orabug 32254008]
    - Send DHCP request in parallel on all interfaces for 80% boot time improvement [Orabug: 32034110]
    - Revert fix for [Orabug: 31404167]
    - drop 51-dracut-rescue.install patch
    - Send DHCP query only on min BDF device to improve boot times by 50-60 secs [Orabug: 31404167]
    - add ofb and cts to 01fips kernel module list [Orabug: 30622737]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Fix kernel-core POSTTRANS script issues with kernel command line [Orabug: 29542203]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Fix BOOTPROTO calculation for iscsi [Orabug: 29518713]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]
    ([email protected])
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [049-244.git20260529]
    - fix(network-manager): escape DHCP lease values in dhcpopts
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2026-26534.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6893");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8:10:baseos_patch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-caps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-config-generic");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-config-rescue");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-live");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-network");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-squash");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dracut-tools");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_product)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Oracle Linux 8.x', 'Oracle Linux ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'dracut-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-caps-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-generic-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-rescue-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-live-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-network-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-squash-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-tools-049-244.git20260529.0.1.el8_10', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-caps-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-generic-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-config-rescue-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-live-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-network-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-squash-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'dracut-tools-049-244.git20260529.0.1.el8_10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dracut / dracut-caps / dracut-config-generic / etc');
}