CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788170774)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(359803);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2021-23133",
    "CVE-2021-47280",
    "CVE-2021-47479",
    "CVE-2021-47565",
    "CVE-2021-47600",
    "CVE-2022-49111",
    "CVE-2022-49478",
    "CVE-2022-49934",
    "CVE-2022-50103",
    "CVE-2022-50185",
    "CVE-2022-50220",
    "CVE-2022-50411",
    "CVE-2022-50432",
    "CVE-2022-50470",
    "CVE-2022-50496",
    "CVE-2022-50551",
    "CVE-2022-50646",
    "CVE-2023-2162",
    "CVE-2023-52818",
    "CVE-2023-52974",
    "CVE-2023-53153",
    "CVE-2023-53265",
    "CVE-2023-53307",
    "CVE-2023-53454",
    "CVE-2023-53524",
    "CVE-2023-53556",
    "CVE-2023-54121",
    "CVE-2023-54243",
    "CVE-2024-0639",
    "CVE-2024-36013",
    "CVE-2025-21753",
    "CVE-2025-21764",
    "CVE-2025-38046",
    "CVE-2025-38103",
    "CVE-2025-38211",
    "CVE-2025-38239",
    "CVE-2025-38563",
    "CVE-2025-39759",
    "CVE-2025-54518",
    "CVE-2025-68798",
    "CVE-2026-22980",
    "CVE-2026-23099",
    "CVE-2026-23318",
    "CVE-2026-31392",
    "CVE-2026-31399",
    "CVE-2026-31500",
    "CVE-2026-31502",
    "CVE-2026-31663",
    "CVE-2026-31788",
    "CVE-2026-43116",
    "CVE-2026-43279",
    "CVE-2026-43281",
    "CVE-2026-43334",
    "CVE-2026-43338",
    "CVE-2026-43339",
    "CVE-2026-43493",
    "CVE-2026-45856",
    "CVE-2026-45861",
    "CVE-2026-45942",
    "CVE-2026-45970",
    "CVE-2026-45984",
    "CVE-2026-46006",
    "CVE-2026-46043",
    "CVE-2026-46052",
    "CVE-2026-46056",
    "CVE-2026-46133",
    "CVE-2026-46149",
    "CVE-2026-46150",
    "CVE-2026-46174",
    "CVE-2026-46189",
    "CVE-2026-46259",
    "CVE-2026-46266",
    "CVE-2026-52918",
    "CVE-2026-52920",
    "CVE-2026-52942",
    "CVE-2026-52956",
    "CVE-2026-52957",
    "CVE-2026-52986",
    "CVE-2026-52998",
    "CVE-2026-53002",
    "CVE-2026-53009",
    "CVE-2026-53062",
    "CVE-2026-53075",
    "CVE-2026-53091",
    "CVE-2026-53112",
    "CVE-2026-53131",
    "CVE-2026-53224",
    "CVE-2026-53228",
    "CVE-2026-53246",
    "CVE-2026-53253",
    "CVE-2026-53254",
    "CVE-2026-53255",
    "CVE-2026-53256",
    "CVE-2026-53264",
    "CVE-2026-53265",
    "CVE-2026-53268",
    "CVE-2026-53270",
    "CVE-2026-53275",
    "CVE-2026-64266",
    "CVE-2026-64298",
    "CVE-2026-64567",
    "CVE-2026-64582",
    "CVE-2026-68093",
    "CVE-2026-68096",
    "CVE-2026-68108",
    "CVE-2026-68121",
    "CVE-2026-68123",
    "CVE-2026-68143",
    "CVE-2026-68153",
    "CVE-2026-68154",
    "CVE-2026-68155",
    "CVE-2026-68156",
    "CVE-2026-68158",
    "CVE-2026-68160",
    "CVE-2026-68176",
    "CVE-2026-68188",
    "CVE-2026-68202",
    "CVE-2026-68226",
    "CVE-2026-68320",
    "CVE-2026-68365",
    "CVE-2026-68376",
    "CVE-2026-68414",
    "CVE-2026-68433",
    "CVE-2026-72396",
    "CVE-2026-72472",
    "CVE-2026-74499",
    "CVE-2026-74583",
    "CVE-2026-74584",
    "CVE-2026-74588",
    "CVE-2026-74624",
    "CVE-2026-74669",
    "CVE-2026-74730"
  );
  script_xref(name:"CLSA", value:"2026:1788170774");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788170774)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1788170774 advisory.

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel
    privilege escalation from the context of a network service or an unprivileged process. If
    sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the
    auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network
    service privileges to escalate to root or from the context of an unprivileged user directly if a
    BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in
    drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving
    file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report
    of the use-after-free error found by Syzbot:
    https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803 In the report, the master
    pointer was used after being freed. This is because another process had acquired the device's master mutex
    in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of
    fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's
    master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot
    reproducer test. (CVE-2021-47280)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during
    drive powercycle test While looping over shost's sdev list it is possible that one of the drives is
    getting removed and its sas_target object is freed but its sdev object remains intact. Consequently, a
    kernel panic can occur while the driver is trying to access the sas_address field of sas_target object
    without also checking the sas_target object for NULL. (CVE-2021-47565)

  - In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in
    rebalance_children() Move dm_tm_unlock() after dm_tm_dec(). (CVE-2021-47600)

  - In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-
    of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing
    validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value
    remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the
    easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
    (CVE-2022-49478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1788170774.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cb80664a");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1788170774");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1788170774.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-23133");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-31788");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-54518");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'bpftool-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-perf-3.10.0-1160.156.1.el7.tuxcare.els3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc');
}