AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1727352561)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360114);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2022-40982",
    "CVE-2023-5717",
    "CVE-2023-52628",
    "CVE-2024-25744",
    "CVE-2024-38538",
    "CVE-2024-38555",
    "CVE-2024-38570",
    "CVE-2024-39471",
    "CVE-2024-40956",
    "CVE-2024-40984",
    "CVE-2024-41000",
    "CVE-2024-41040",
    "CVE-2024-41073",
    "CVE-2024-42284",
    "CVE-2024-42285",
    "CVE-2024-42301",
    "CVE-2024-44987",
    "CVE-2024-46673"
  );
  script_xref(name:"CLSA", value:"2024:1727352561");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1727352561)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2024:1727352561 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector
    execution units for some Intel(R) Processors may allow an authenticated user to potentially enable
    information disclosure via local access. (CVE-2022-40982)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix
    4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination
    array which leads to stack corruption. This construct is necessary to clean the remainder of the register
    in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.
    The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.
    Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
    (CVE-2023-52628)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)
    component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an
    event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory
    locations outside of the allocated buffer. We recommend upgrading past commit
    32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

  - In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point.
    This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. (CVE-2024-25744)

  - In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have
    at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by
    sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount
    instead of assuming. Tested with dropwatch: drop at: br_dev_xmit+0xb93/0x12d0 [bridge]
    (0xffffffffc06739b3) origin: software timestamp: Mon May 13 11:31:53 2024 778214037 nsec protocol: 0x88a8
    length: 2 original length: 2 drop reason: PKT_TOO_SMALL [1] BUG: KMSAN: uninit-value in
    br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65 br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
    __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit
    include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline]
    dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341
    dev_queue_xmit include/linux/netdevice.h:3091 [inline] __bpf_tx_skb net/core/filter.c:2136 [inline]
    __bpf_redirect_common net/core/filter.c:2180 [inline] __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187
    ____bpf_clone_redirect net/core/filter.c:2460 [inline] bpf_clone_redirect+0x328/0x470
    net/core/filter.c:2432 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 __bpf_prog_run512+0xb5/0xe0
    kernel/bpf/core.c:2238 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run
    include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline]
    bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425 bpf_prog_test_run_skb+0x14ea/0x1f20
    net/bpf/test_run.c:1058 bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269 __sys_bpf+0x6aa/0xd90
    kernel/bpf/syscall.c:5678 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] __se_sys_bpf
    kernel/bpf/syscall.c:5765 [inline] __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765
    x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64
    arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
    entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-38538)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2024/clsa-2024_1727352561.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c766789b");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2024:1727352561");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2024:1727352561.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-46673");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-25744");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'bpftool-7.0.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-abi-stablelists-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-matched-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-core-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-partner-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-uki-virt-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-matched-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-core-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-partner-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-284.30.1.el9_2.tuxcare.els7', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');
}