CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791730242)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366515);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/19");

  script_cve_id(
    "CVE-2023-4244",
    "CVE-2025-39964",
    "CVE-2026-31411",
    "CVE-2026-52923",
    "CVE-2026-53059",
    "CVE-2026-53195",
    "CVE-2026-53196",
    "CVE-2026-53266",
    "CVE-2026-64191",
    "CVE-2026-64340",
    "CVE-2026-64343",
    "CVE-2026-64372",
    "CVE-2026-64375",
    "CVE-2026-68106",
    "CVE-2026-68111",
    "CVE-2026-68175",
    "CVE-2026-68218",
    "CVE-2026-68234",
    "CVE-2026-68299",
    "CVE-2026-68425",
    "CVE-2026-72005",
    "CVE-2026-72019",
    "CVE-2026-72020",
    "CVE-2026-72036",
    "CVE-2026-72039",
    "CVE-2026-72083",
    "CVE-2026-72106",
    "CVE-2026-74469",
    "CVE-2026-74720",
    "CVE-2026-80676",
    "CVE-2026-80844",
    "CVE-2026-81000"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/09/21");
  script_xref(name:"CLSA", value:"2026:1791730242");

  script_name(english:"CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791730242)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS7:CLSA-2026:1791730242 advisory.

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to
    achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane
    transaction and nft_set element garbage collection, it is possible to underflow the reference counter
    causing a use-after-free vulnerability. We recommend upgrading past commit
    3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent
    writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be
    interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the
    internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership
    for writing. (CVE-2025-39964)

  - In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated
    vcc pointer in sigd_send() Reproducer available at [1]. The ATM send path (sendmsg -> vcc_sendmsg ->
    sigd_send) reads the vcc pointer from msg->vcc and uses it directly without any validation. This pointer
    comes from userspace via sendmsg() and can be arbitrarily forged: int fd = socket(AF_ATMSVC, SOCK_DGRAM,
    0); ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon struct msghdr msg = { .msg_iov = &iov, ... };
    *(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer sendmsg(fd, &msg, 0); // kernel dereferences
    0xdeadbeef In normal operation, the kernel sends the vcc pointer to the signaling daemon via sigd_enq()
    when processing operations like connect(), bind(), or listen(). The daemon is expected to return the same
    pointer when responding. However, a malicious daemon can send arbitrary pointer values. Fix this by
    introducing find_get_vcc() which validates the pointer by searching through vcc_hash (similar to how
    sigd_close() iterates over all VCCs), and acquires a reference via sock_hold() if found. Since struct
    atm_vcc embeds struct sock as its first member, they share the same lifetime. Therefore using
    sock_hold/sock_put is sufficient to keep the vcc alive while it is being used. Note that there may be a
    race with sigd_close() which could mark the vcc with various flags (e.g., ATM_VF_RELEASED) after
    find_get_vcc() returns. However, sock_hold() guarantees the memory remains valid, so this race only
    affects the logical state, not memory safety. [1]:
    https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3 (CVE-2026-31411)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the
    valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id.
    ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the
    valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV
    IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This
    leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in
    the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new,
    ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once
    the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the
    valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id
    = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses:
    ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can
    then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the
    current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent
    walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by
    bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is
    exhausted. (CVE-2026-52923)

  - In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to
    region_count overflow The local variable region_count in create_log_context() is declared as unsigned int
    (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently
    large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is
    then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far
    smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit,
    log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing
    out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a
    mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero'
    dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \
    /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297,
    because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1
    1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-
    worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive
    fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit
    overflow check before the value is assigned to lc->region_count. (CVE-2026-53059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1791730242.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a589b247");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1791730242");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1791730242.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53196");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-64343");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^7([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 7', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'bpftool-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python-perf-3.10.0-1160.164.1.el7.tuxcare.els1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc');
}