TencentOS Server 4: kernel (TSSA-2026:0708)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0708.
##

include('compat.inc');

if (description)
{
  script_id(330783);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id(
    "CVE-2025-37903",
    "CVE-2025-37928",
    "CVE-2025-38011",
    "CVE-2025-38012",
    "CVE-2025-38022",
    "CVE-2025-38057",
    "CVE-2025-38060",
    "CVE-2025-38087",
    "CVE-2025-38089",
    "CVE-2025-38125",
    "CVE-2025-38193",
    "CVE-2025-38264"
  );

  script_name(english:"TencentOS Server 4: kernel (TSSA-2026:0708)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0708 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-38264:
    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem

    Call Trace:

     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:408 [inline]
     print_report+0xc3/0x670 mm/kasan/report.c:521
     kasan_report+0xe0/0x110 mm/kasan/report.c:634
     strlen+0x93/0xa0 lib/string.c:420
     __fortify_strlen include/linux/fortify-string.h:268 [inline]
     get_kobj_path_length lib/kobject.c:118 [inline]
     kobject_get_path+0x3f/0x2a0 lib/kobject.c:158
     kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
     ib_register_device drivers/infiniband/core/device.c:1472 [inline]
     ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393
     rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
     rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550
     rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225
     nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796
     rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195
     rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450
     netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
     netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
     netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
     sock_sendmsg_nosec net/socket.c:712 [inline]
     __sock_sendmsg net/socket.c:727 [inline]
     ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
     ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
     __sys_sendmsg+0x16d/0x220 net/socket.c:2652
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    This problem is similar to the problem that the
    commit 1d6a9e7449e2 (RDMA/core: Fix use-after-free when rename device name)
    fixes.

    The root cause is: the function ib_device_rename() renames the name with
    lock. But in the function kobject_uevent(), this name is accessed without
    lock protection at the same time.

    The solution is to add the lock protection when this name is accessed in
    the function kobject_uevent().

    CVE-2025-38012:
    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: reject invalid perturb period

    Gerrard Tai reported that SFQ perturb_period has no range check yet,
    and this can be used to trigger a race condition fixed in a separate patch.

    We want to make sure ctl->perturb_period * HZ will not overflow
    and is positive.


    tc qd add dev lo root sfq perturb -10   # negative value : error
    Error: sch_sfq: invalid perturb period.

    tc qd add dev lo root sfq perturb 1000000000 # too big : error
    Error: sch_sfq: invalid perturb period.

    tc qd add dev lo root sfq perturb 2000000 # acceptable value
    tc -s -d qd sh dev lo
    qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec
     Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
     backlog 0b 0p requeues 0

    CVE-2025-38060:
    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: csa unmap use uninterruptible lock

    After process exit to unmap csa and free GPU vm, if signal is accepted
    and then waiting to take vm lock is interrupted and return, it causes
    memory leaking and below warning backtrace.

    Change to use uninterruptible wait lock fix the issue.

    WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525
     amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu]
     Call Trace:
    <TASK>
    drm_file_free.part.0+0x1da/0x230 [drm]
    drm_close_helper.isra.0+0x65/0x70 [drm]
    drm_release+0x6a/0x120 [drm]
    amdgpu_drm_release+0x51/0x60 [amdgpu]
    __fput+0x9f/0x280
    ____fput+0xe/0x20
    task_work_run+0x67/0xa0
    do_exit+0x217/0x3c0
    do_group_exit+0x3b/0xb0
    get_signal+0x14a/0x8d0
    arch_do_signal_or_restart+0xde/0x100
    exit_to_user_mode_loop+0xc1/0x1a0
    exit_to_user_mode_prepare+0xf4/0x100
    syscall_exit_to_user_mode+0x17/0x40
    do_syscall_64+0x69/0xc0

    (cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)

    CVE-2025-38125:
    In the Linux kernel, the following vulnerability has been resolved:

    bpf: copy_verifier_state() should copy 'loop_entry' field

    The bpf_verifier_state.loop_entry state should be copied by
    copy_verifier_state(). Otherwise, .loop_entry values from unrelated
    states would poison env->cur_state.

    Additionally, env->stack should not contain any states with
    .loop_entry != NULL. The states in env->stack are yet to be verified,
    while .loop_entry is set for states that reached an equivalent state.
    This means that env->cur_state->loop_entry should always be NULL after
    pop_stack().

    See the selftest in the next commit for an example of the program that
    is not safe yet is accepted by verifier w/o this fix.

    This change has some verification performance impact for selftests:

    File                                Program                       Insns (A)  Insns (B)  Insns   (DIFF)
    States (A)  States (B)  States (DIFF)
    ----------------------------------  ----------------------------  ---------  ---------  --------------
    ----------  ----------  -------------
    arena_htab.bpf.o                    arena_htab_llvm                     717        426  -291 (-40.59%)
    57          37  -20 (-35.09%)
    arena_htab_asm.bpf.o                arena_htab_asm                      597        445  -152 (-25.46%)
    47          37  -10 (-21.28%)
    arena_list.bpf.o                    arena_list_del                      309        279    -30 (-9.71%)
    23          14   -9 (-39.13%)
    iters.bpf.o                         iter_subprog_check_stacksafe        155        141    -14 (-9.03%)
    15          14    -1 (-6.67%)
    iters.bpf.o                         iter_subprog_iters                 1094       1003    -91 (-8.32%)
    88          83    -5 (-5.68%)
    iters.bpf.o                         loop_state_deps2                    479        725  +246 (+51.36%)
    46          63  +17 (+36.96%)
    kmem_cache_iter.bpf.o               open_coded_iter                      63         59     -4 (-6.35%)
    7           6   -1 (-14.29%)
    verifier_bits_iter.bpf.o            max_words                            92         84     -8 (-8.70%)
    8           7   -1 (-12.50%)
    verifier_iterating_callbacks.bpf.o  cond_break2                         113        107     -6 (-5.31%)
    12          12    +0 (+0.00%)

    And significant negative impact for sched_ext:

    File               Program                 Insns (A)  Insns (B)  Insns         (DIFF)  States (A)  States
    (B)  States      (DIFF)
    -----------------  ----------------------  ---------  ---------  --------------------  ----------
    ----------  ------------------
    bpf.bpf.o          lavd_init                    7039      14723      +7684 (+109.16%)         490
    1139     +649 (+132.45%)
    bpf.bpf.o          layered_dispatch            11485      10548         -937 (-8.16%)         848
    762       -86 (-10.14%)
    bpf.bpf.o          layered_dump                 7422    1000001  +992579 (+13373.47%)         681
    31178  +30497 (+4478.27%)
    bpf.bpf.o          layered_enqueue             16854      71127     +54273 (+322.02%)        1611
    6450    +4839 (+300.37%)
    bpf.bpf.o          p2dq_dispatch                 665        791        +126 (+18.95%)          68
    78       +10 (+14.71%)
    bpf.bpf.o          p2dq_init                    2343       2980        +637 (+27.19%)         201
    237       +36 (+17.91%)
    bpf.bpf.o          refresh_layer_cpumasks      16487     674760   +658273 (+3992.68%)        1770
    65370  +63600 (+3593.22%)
    bpf.bpf.o          rusty_select_cpu             1937      40872    +38935 (+2010.07%)         177
    3210   +3033 (+1713.56%)
    scx_central.bpf.o  central_dispatch              636       2687      +2051 (+322.48%)          63
    227     +164 (+260.32%)
    scx_nest.bpf.o     nest_init                     636        815        +179 (+28.14%)          60
    73       +13 (+21.67%)
    scx_qmap.bpf.o     qmap_dispatch
    ---truncated---

    CVE-2025-38089:
    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: sanitize request list handling

    Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
    any list, otherwise a malicious R2T PDU might inject a loop in request
    list processing.

    CVE-2025-37928:
    In the Linux kernel, the following vulnerability has been resolved:

    net: stmmac: make sure that ptp_rate is not 0 before configuring EST

    If the ptp_rate recorded earlier in the driver happens to be 0, this
    bogus value will propagate up to EST configuration, where it will
    trigger a division by 0.

    Prevent this division by 0 by adding the corresponding check and error
    code.

    CVE-2025-38087:
    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator

    BPF programs may call next() and destroy() on BPF iterators even after new()
    returns an error value (e.g. bpf_for_each() macro ignores error returns from
    new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized
    state after an error return causing bpf_iter_scx_dsq_next() to dereference
    garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that
    next() and destroy() become noops.

    CVE-2025-38011:
    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

    tianshuo han reported a remotely-triggerable crash if the client sends a
    kernel RPC server a specially crafted packet. If decoding the RPC reply
    fails in such a way that SVC_GARBAGE is returned without setting the
    rq_accept_statp pointer, then that pointer can be dereferenced and a
    value stored there.

    If it's the first time the thread has processed an RPC, then that
    pointer will be set to NULL and the kernel will crash. In other cases,
    it could create a memory scribble.

    The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate
    or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531
    says that if authentication fails that the RPC should be rejected
    instead with a status of AUTH_ERR.

    Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of
    AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This
    sidesteps the whole problem of touching the rpc_accept_statp pointer in
    this situation and avoids the crash.

    CVE-2025-38022:
    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix use-after-free in taprio_dev_notifier

    Since taprios taprio_dev_notifier() isnt protected by an
    RCU read-side critical section, a race with advance_sched()
    can lead to a use-after-free.

    Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.

    CVE-2025-37903:
    In the Linux kernel, the following vulnerability has been resolved:

    espintcp: fix skb leaks

    A few error paths are missing a kfree_skb.

    CVE-2025-38057:
    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/display: Fix slab-use-after-free in hdcp

    The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector
    objects without incrementing the kref reference counts. When using a
    USB-C dock, and the dock is unplugged, the corresponding
    amdgpu_dm_connector objects are freed, creating dangling pointers in the
    HDCP code. When the dock is plugged back, the dangling pointers are
    dereferenced, resulting in a slab-use-after-free:

    [   66.775837] BUG: KASAN: slab-use-after-free in event_property_validate+0x42f/0x6c0 [amdgpu]
    [   66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10

    [   66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty
    #233
    [   66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024
    [   66.776186] Workqueue: events event_property_validate [amdgpu]
    [   66.776494] Call Trace:
    [   66.776496]  <TASK>
    [   66.776497]  dump_stack_lvl+0x70/0xa0
    [   66.776504]  print_report+0x175/0x555
    [   66.776507]  ? __virt_addr_valid+0x243/0x450
    [   66.776510]  ? kasan_complete_mode_report_info+0x66/0x1c0
    [   66.776515]  kasan_report+0xeb/0x1c0
    [   66.776518]  ? event_property_validate+0x42f/0x6c0 [amdgpu]
    [   66.776819]  ? event_property_validate+0x42f/0x6c0 [amdgpu]
    [   66.777121]  __asan_report_load4_noabort+0x14/0x20
    [   66.777124]  event_property_validate+0x42f/0x6c0 [amdgpu]
    [   66.777342]  ? __lock_acquire+0x6b40/0x6b40
    [   66.777347]  ? enable_assr+0x250/0x250 [amdgpu]
    [   66.777571]  process_one_work+0x86b/0x1510
    [   66.777575]  ? pwq_dec_nr_in_flight+0xcf0/0xcf0
    [   66.777578]  ? assign_work+0x16b/0x280
    [   66.777580]  ? lock_is_held_type+0xa3/0x130
    [   66.777583]  worker_thread+0x5c0/0xfa0
    [   66.777587]  ? process_one_work+0x1510/0x1510
    [   66.777588]  kthread+0x3a2/0x840
    [   66.777591]  ? kthread_is_per_cpu+0xd0/0xd0
    [   66.777594]  ? trace_hardirqs_on+0x4f/0x60
    [   66.777597]  ? _raw_spin_unlock_irq+0x27/0x60
    [   66.777599]  ? calculate_sigpending+0x77/0xa0
    [   66.777602]  ? kthread_is_per_cpu+0xd0/0xd0
    [   66.777605]  ret_from_fork+0x40/0x90
    [   66.777607]  ? kthread_is_per_cpu+0xd0/0xd0
    [   66.777609]  ret_from_fork_asm+0x11/0x20
    [   66.777614]  </TASK>

    [   66.777643] Allocated by task 10:
    [   66.777646]  kasan_save_stack+0x39/0x60
    [   66.777649]  kasan_save_track+0x14/0x40
    [   66.777652]  kasan_save_alloc_info+0x37/0x50
    [   66.777655]  __kasan_kmalloc+0xbb/0xc0
    [   66.777658]  __kmalloc_cache_noprof+0x1c8/0x4b0
    [   66.777661]  dm_dp_add_mst_connector+0xdd/0x5c0 [amdgpu]
    [   66.777880]  drm_dp_mst_port_add_connector+0x47e/0x770 [drm_display_helper]
    [   66.777892]  drm_dp_send_link_address+0x1554/0x2bf0 [drm_display_helper]
    [   66.777901]  drm_dp_check_and_send_link_address+0x187/0x1f0 [drm_display_helper]
    [   66.777909]  drm_dp_mst_link_probe_work+0x2b8/0x410 [drm_display_helper]
    [   66.777917]  process_one_work+0x86b/0x1510
    [   66.777919]  worker_thread+0x5c0/0xfa0
    [   66.777922]  kthread+0x3a2/0x840
    [   66.777925]  ret_from_fork+0x40/0x90
    [   66.777927]  ret_from_fork_asm+0x11/0x20

    [   66.777932] Freed by task 1713:
    [   66.777935]  kasan_save_stack+0x39/0x60
    [   66.777938]  kasan_save_track+0x14/0x40
    [   66.777940]  kasan_save_free_info+0x3b/0x60
    [   66.777944]  __kasan_slab_free+0x52/0x70
    [   66.777946]  kfree+0x13f/0x4b0
    [   66.777949]  dm_dp_mst_connector_destroy+0xfa/0x150 [amdgpu]
    [   66.778179]  drm_connector_free+0x7d/0xb0
    [   66.778184]  drm_mode_object_put.part.0+0xee/0x160
    [   66.778188]  drm_mode_object_put+0x37/0x50
    [   66.778191]  drm_atomic_state_default_clear+0x220/0xd60
    [   66.778194]  __drm_atomic_state_free+0x16e/0x2a0
    [   66.778197]  drm_mode_atomic_ioctl+0x15ed/0x2ba0
    [   66.778200]  drm_ioctl_kernel+0x17a/0x310
    [   66.778203]  drm_ioctl+0x584/0xd10
    [   66.778206]  amdgpu_drm_ioctl+0xd2/0x1c0 [amdgpu]
    [   66.778375]  __x64_sys_ioctl+0x139/0x1a0
    [   66.778378]  x64_sys_call+0xee7/0xfb0
    [   66.778381]
    ---truncated---

    CVE-2025-38193:
    In the Linux kernel, the following vulnerability has been resolved:

    dm-bufio: don't schedule in atomic context

    A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and
    try_verify_in_tasklet are enabled.
    [  129.444685][  T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421
    [  129.444723][  T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4
    [  129.444740][  T934] preempt_count: 201, expected: 0
    [  129.444756][  T934] RCU nest depth: 0, expected: 0
    [  129.444781][  T934] Preemption disabled at:
    [  129.444789][  T934] [<ffffffd816231900>] shrink_work+0x21c/0x248
    [  129.445167][  T934] kernel BUG at kernel/sched/walt/walt_debug.c:16!
    [  129.445183][  T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
    [  129.445204][  T934] Skip md ftrace buffer dump for: 0x1609e0
    [  129.447348][  T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G        W  OE
    6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8
    [  129.447362][  T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT)
    [  129.447373][  T934] Workqueue: dm_bufio_cache shrink_work
    [  129.447394][  T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [  129.447406][  T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug]
    [  129.447435][  T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c
    [  129.447451][  T934] sp : ffffffc0843dbc90
    [  129.447459][  T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b
    [  129.447479][  T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68
    [  129.447497][  T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900
    [  129.447517][  T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030
    [  129.447535][  T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358
    [  129.447554][  T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003
    [  129.447572][  T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400
    [  129.447591][  T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8
    [  129.447610][  T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0
    [  129.447629][  T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000
    [  129.447647][  T934] Call trace:
    [  129.447655][  T934]  android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug
    1400000003000000474e550080cce8a8a78606b6]
    [  129.447681][  T934]  __might_resched+0x190/0x1a8
    [  129.447694][  T934]  shrink_work+0x180/0x248
    [  129.447706][  T934]  process_one_work+0x260/0x624
    [  129.447718][  T934]  worker_thread+0x28c/0x454
    [  129.447729][  T934]  kthread+0x118/0x158
    [  129.447742][  T934]  ret_from_fork+0x10/0x20
    [  129.447761][  T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000)
    [  129.447772][  T934] ---[ end trace 0000000000000000 ]---

    dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet
    is enabled, and __scan will be called in atomic context.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260708.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38087");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:kernel");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'bpftool-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-debuginfo-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-debuginfo-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-common-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-common-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-signing-keys-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-signing-keys-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-source-6.6.98-39.1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-debuginfo-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-debuginfo-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mlnx-ofed-dist-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-debuginfo-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-debuginfo-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-debuginfo-6.6.98-39.1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-debuginfo-6.6.98-39.1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / bpftool-debuginfo / kernel / etc');
}