AlmaLinux 9.2 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792508765)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367926);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-19774",
    "CVE-2026-75032",
    "CVE-2026-80185",
    "CVE-2026-80186",
    "CVE-2026-85218"
  );
  script_xref(name:"CLSA", value:"2026:1792508765");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792508765)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1792508765 advisory.

  - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows
    network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must
    first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit
    this vulnerability. The specific flaw exists within the handling of the stream endpoints. The issue
    results from the lack of proper validation of the length of user-supplied data prior to copying it to a
    fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the
    context of root. Was ZDI-CAN-29429. (CVE-2026-19774)

  - A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses
    within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device
    within range to cause an out-of-bounds memory read. This vulnerability, affecting the
    parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon,
    resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents.
    Exploitation requires user interaction to pair with the malicious device. (CVE-2026-75032)

  - BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a
    crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a
    sequence pointer, allowing a local caller to crash bluetoothd. (CVE-2026-80185)

  - A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote
    user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that
    causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead
    to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code
    execution. (CVE-2026-80186)

  - AVRCP ListPlayerAttributes double stack overflow in
    avrcp_list_player_attributes_rsp/avrcp_get_current_player_value [fedora-all] (CVE-2026-85218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1792508765.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?991aa4d1");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1792508765");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1792508765.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-80186");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'bluez-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-cups-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-cups-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-cups-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-hid2hci-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-hid2hci-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-hid2hci-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-devel-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-devel-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-libs-devel-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-mesh-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-mesh-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-mesh-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-obexd-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-obexd-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'bluez-obexd-5.72-4.el9.tuxcare.els2', 'sp':'2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc');
}