AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1738671431)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352744);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2022-48988",
    "CVE-2023-52475",
    "CVE-2023-52504",
    "CVE-2023-52519",
    "CVE-2023-52531",
    "CVE-2023-52614",
    "CVE-2023-52818",
    "CVE-2024-26689",
    "CVE-2024-26754",
    "CVE-2024-27043",
    "CVE-2024-35861",
    "CVE-2024-35868",
    "CVE-2024-36012",
    "CVE-2024-41057",
    "CVE-2024-41058",
    "CVE-2024-49996",
    "CVE-2024-50115",
    "CVE-2024-50124",
    "CVE-2024-50125",
    "CVE-2024-50262",
    "CVE-2024-50264",
    "CVE-2024-53057",
    "CVE-2024-53103",
    "CVE-2024-53141",
    "CVE-2024-53142",
    "CVE-2024-53150",
    "CVE-2024-53156",
    "CVE-2024-53173",
    "CVE-2024-53179",
    "CVE-2024-56600",
    "CVE-2024-56601",
    "CVE-2024-56602",
    "CVE-2024-56603",
    "CVE-2024-56604",
    "CVE-2024-56605",
    "CVE-2024-56608",
    "CVE-2024-56614",
    "CVE-2024-56631",
    "CVE-2024-56642",
    "CVE-2024-56662",
    "CVE-2024-56664",
    "CVE-2024-56672",
    "CVE-2024-56708"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/04/30");
  script_xref(name:"CLSA", value:"2025:1738671431");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1738671431)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2025:1738671431 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in
    memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified
    control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access
    d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't
    be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 (memcg: remove
    cgroup_event->cft), there was a call to __file_cft() which verified that the specified file is a regular
    cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer
    necessary and the commit inadvertently dropped the file type check with it allowing any file to slip
    through. With the invarients broken, the d_name and parent accesses can now race against renames and
    removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in
    __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go
    through a layer of indirection. Instead, let's check the superblock and dentry type. (CVE-2022-48988)

  - In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free
    in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This
    happens when the device is disconnected, which leads to a memory free from the powermate_device struct.
    When an asynchronous control message completes after the kfree and its callback is invoked, the lock does
    not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests
    upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
    (CVE-2023-52475)

  - In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in
    apply_alternatives() Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging
    machine: BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task
    swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early()
    apply_alternatives() ... On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets
    patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is
    defined with cpu_feature_enabled(). KASAN gets confused when apply_alternatives() patches the
    KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing
    __VIRTUAL_MASK_SHIFT with 56, works around the issue. Fix it for real by disabling KASAN while the kernel
    is patching alternatives. [ mingo: updated the changelog ] (CVE-2023-52504)

  - In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and
    reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which
    allows to wakup device when the system is in S5 (Soft-Off state). This OOB service can be enabled/disabled
    from BIOS settings. When enabled, the ISH device gets PME wake capability. To enable PME wakeup, driver
    also needs to enable ACPI GPE bit. On resume, BIOS will clear the wakeup bit. So driver need to re-enable
    it in resume function to keep the next wakeup capability. But this BIOS clearing of wakeup bit doesn't
    decrement internal OS GPE reference count, so this reenabling on every resume will cause reference count
    to overflow. So first disable and reenable ACPI GPE bit using acpi_disable_gpe(). (CVE-2023-52519)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory
    corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct
    ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is
    fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct
    ieee80211_channel'. So only 1 element is allocated in this array. When doing:
    mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the
    'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void
    *)((u8 *)mvm->nvm_data->channels + 1); because of the (u8 *) cast, we add only 1 to the address of the
    beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just
    after. Remove the spurious casting so that the pointer arithmetic works as expected. (CVE-2023-52531)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2025/clsa-2025_1738671431.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2bc67532");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2025:1738671431");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2025:1738671431.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-56708");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/02/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'bpftool-7.0.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-abi-stablelists-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-matched-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-core-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-partner-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-uki-virt-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-matched-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-core-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-partner-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-284.30.1.el9_2.tuxcare.els10', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');
}