CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1768110920)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362238);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2022-2978",
    "CVE-2022-43945",
    "CVE-2022-50367",
    "CVE-2022-50403",
    "CVE-2022-50410",
    "CVE-2023-53322",
    "CVE-2024-35886",
    "CVE-2025-38004",
    "CVE-2025-38051",
    "CVE-2025-38068",
    "CVE-2025-38157",
    "CVE-2025-38245",
    "CVE-2025-38415",
    "CVE-2025-38459",
    "CVE-2025-38729",
    "CVE-2025-39757",
    "CVE-2025-39863",
    "CVE-2025-39955",
    "CVE-2025-40186"
  );
  script_xref(name:"CLSA", value:"2026:1768110920");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1768110920)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1768110920 advisory.

  - A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function
    security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use
    this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2022-2978)

  - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer
    overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send
    buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer
    to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC
    message with garbage data is still correctly formed according to the specification and is passed forward
    to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the
    allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

  - In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in
    nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc()
    fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and
    nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and
    leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to
    this_cpu_inc(nr_inodes) (CVE-2022-50367)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer
    overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd
    thread by combining the RPC receive and send buffers into a single array of pages. This works because
    there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same
    time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of
    rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks
    when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by
    sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full
    maximum payload size cannot be constructed in that case. (CVE-2022-50410)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on
    terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before
    making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear
    down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is
    called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final
    cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same
    resource. Wait for IO's to return to upper layer before resources are freed. (CVE-2023-53322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1768110920.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f642b1d1");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1768110920");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1768110920.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39955");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'bpftool-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-perf-3.10.0-1160.139.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc');
}