CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789037015)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352722);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2021-47328",
    "CVE-2023-53473",
    "CVE-2026-45944",
    "CVE-2026-46177",
    "CVE-2026-53120",
    "CVE-2026-53186",
    "CVE-2026-63829",
    "CVE-2026-64322",
    "CVE-2026-64323",
    "CVE-2026-64341",
    "CVE-2026-64344",
    "CVE-2026-64348",
    "CVE-2026-64411",
    "CVE-2026-64413",
    "CVE-2026-64422",
    "CVE-2026-64448",
    "CVE-2026-68184",
    "CVE-2026-68300",
    "CVE-2026-68349",
    "CVE-2026-68350",
    "CVE-2026-68351",
    "CVE-2026-68430",
    "CVE-2026-68469",
    "CVE-2026-72051",
    "CVE-2026-72053",
    "CVE-2026-72054",
    "CVE-2026-72055",
    "CVE-2026-72061",
    "CVE-2026-72113",
    "CVE-2026-72115",
    "CVE-2026-72116",
    "CVE-2026-72117",
    "CVE-2026-72118",
    "CVE-2026-72122",
    "CVE-2026-72308",
    "CVE-2026-74456",
    "CVE-2026-74464",
    "CVE-2026-74580",
    "CVE-2026-74587",
    "CVE-2026-74597",
    "CVE-2026-74630",
    "CVE-2026-74637",
    "CVE-2026-74641",
    "CVE-2026-74656",
    "CVE-2026-74682",
    "CVE-2026-74688",
    "CVE-2026-74705",
    "CVE-2026-74725",
    "CVE-2026-74752",
    "CVE-2026-80558",
    "CVE-2026-80576"
  );
  script_xref(name:"CLSA", value:"2026:1789037015");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789037015)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1789037015 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free
    during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the
    EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do
    one TMF per session so this just moves the TMF fields from the conn to the session. We can then rely on
    the iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call to remove the target and
    it's devices, and know after that point there is no device or scsi-ml callout trying to access the
    session. (CVE-2021-47328)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from
    ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was
    first introduced. However, with the addition of support of encrypted, casefolded file names, that function
    can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and
    reflect the errors back up to their callers. (CVE-2023-53473)

  - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before
    tearing down context entry When tearing down a context entry, the current implementation zeros the entire
    128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a torn
    entry  where some fields are already zeroed while the 'Present' bit is still set  leading to
    unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may
    reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the
    hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the
    Guidance to Software for Invalidations in the VT-d spec (Section 6.5.3.3) by implementing the
    recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal
    the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is
    visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no
    longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is
    complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before
    the 'Present' bit becomes visible. (CVE-2026-45944)

  - In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive
    message requests The driver would just fetch events and receive messages until the BMC said it was done.
    To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition,
    an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch
    to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck,
    it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck.
    This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general
    issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver.
    It's not a bug per-se, but it is accounting for bugs in BMCs. (CVE-2026-46177)

  - In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override
    infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called
    without the device lock held, thus accessing the driver_override field without a lock, which can cause a
    UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking
    internally. Note that calling match() from __driver_attach() without the device lock held is intentional.
    [1] (CVE-2026-53120)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1789037015.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aef1b8c9");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1789037015");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1789037015.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64348");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'bpftool-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-perf-3.10.0-1160.156.1.el7.tuxcare.els4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc');
}