TencentOS Server 3: kernel (TSSA-2026:1155)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1155.
##

include('compat.inc');

if (description)
{
  script_id(365133);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/13");

  script_cve_id(
    "CVE-2025-39964",
    "CVE-2026-46331",
    "CVE-2026-53212",
    "CVE-2026-53266"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/09/21");

  script_name(english:"TencentOS Server 3: kernel (TSSA-2026:1155)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1155 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-46331:
    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix pedit partial COW leading to page cache corruption

    tcf_pedit_act() computes the COW range for skb_ensure_writable()
    once before the key loop using tcfp_off_max_hint, but the hint does
    not account for the runtime header offset added by typed keys. This
    can leave part of the write region un-COW'd.

    Fix by moving skb_ensure_writable() inside the per-key loop where
    the actual write offset is known, and add overflow checking on the
    offset arithmetic. For negative offsets (e.g. Ethernet header edits
    at ingress), use skb_cow() to COW the headroom instead. Guard
    offset_valid() against INT_MIN, where negation is undefined.

    CVE-2026-53212:
    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_tunnel: fix use-after-free on object destroy

    nft_tunnel_obj_destroy() calls metadata_dst_free() which directly
    kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets
    that took a reference via dst_hold() in nft_tunnel_obj_eval() and
    are still queued (e.g. in a netem qdisc) are left with a dangling
    pointer. When these packets are eventually dequeued, dst_release()
    operates on freed memory.

    Replace metadata_dst_free() with dst_release() so the metadata_dst
    is freed only after all references are dropped. The dst subsystem
    already handles metadata_dst cleanup in dst_destroy() when
    DST_METADATA is set.

    CVE-2025-39964:
    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    Issuing two writes to the same af_alg socket is bogus as the
    data will be interleaved in an unpredictable fashion.  Furthermore,
    concurrent writes may create inconsistencies in the internal
    socket state.

    Disallow this by adding a new ctx->write field that indiciates
    exclusive ownership for writing.

    CVE-2026-53266:
    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bridge: make ebt_snat ARP rewrite writable

    The ebtables SNAT target keeps the Ethernet source address rewrite
    behind skb_ensure_writable(skb, 0).  This is intentional: at the bridge
    ebtables hooks the Ethernet header is addressed through
    skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
    payload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check
    the payload, not the Ethernet header, and would reintroduce the small
    packet regression fixed by commit 63137bc5882a.

    However, the optional ARP sender hardware address rewrite is different.
    It writes through skb_store_bits() at an offset relative to skb->data:

          skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)

    skb_header_pointer() only safely reads the ARP header; it does not make
    the later sender hardware address range writable.  If that range is
    still held in a nonlinear skb fragment backed by a splice-imported file
    page, skb_store_bits() maps the frag page and copies the new MAC address
    directly into it.

    Ensure the ARP SHA range is writable before reading the ARP header and
    before calling skb_store_bits().

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261155.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39964");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:kernel");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'bpftool-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bpftool-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-common-aarch64-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debuginfo-common-x86_64-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mlnx-ofed-dist-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mlnx-ofed-dist-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-debuginfo-5.4.119-19.0009.67.5.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / bpftool-debuginfo / kernel / etc');
}