AlmaLinux 9.2 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787242456)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(361126);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id("CVE-2024-25260", "CVE-2025-1376", "CVE-2025-1377");
  script_xref(name:"CLSA", value:"2026:1787242456");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787242456)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1787242456 advisory.

  - elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at
    readelf.c. (CVE-2024-25260)

  - A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the
    function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads
    to denial of service. It is possible to launch the attack on the local host. The complexity of an attack
    is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and
    may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply
    a patch to fix this issue. (CVE-2025-1376)

  - A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue
    affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation
    leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to
    the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is
    recommended to apply a patch to fix this issue. (CVE-2025-1377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1787242456.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3cd1bc1");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1787242456");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1787242456.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-1377");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'elfutils-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-debuginfod-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-debuginfod-client-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-debuginfod-client-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-debuginfod-client-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-debuginfod-client-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-default-yama-scope-0.188-3.el9.tuxcare.els1', 'sp':'2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libelf-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libelf-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libelf-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libelf-devel-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libs-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'elfutils-libs-0.188-3.el9.tuxcare.els1', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc');
}