CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(361173);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2021-47118",
    "CVE-2021-47153",
    "CVE-2022-21546",
    "CVE-2022-48883",
    "CVE-2022-49503",
    "CVE-2022-49581",
    "CVE-2022-49674",
    "CVE-2022-49770",
    "CVE-2022-49799",
    "CVE-2022-49826",
    "CVE-2022-49865",
    "CVE-2022-49870",
    "CVE-2022-49907",
    "CVE-2022-49917",
    "CVE-2022-49934",
    "CVE-2022-49948",
    "CVE-2022-49975",
    "CVE-2022-50030",
    "CVE-2022-50050",
    "CVE-2022-50084",
    "CVE-2022-50085",
    "CVE-2022-50093",
    "CVE-2022-50103",
    "CVE-2022-50164",
    "CVE-2022-50185",
    "CVE-2022-50200",
    "CVE-2022-50220",
    "CVE-2022-50243",
    "CVE-2022-50252",
    "CVE-2022-50279",
    "CVE-2022-50403",
    "CVE-2022-50406",
    "CVE-2022-50497",
    "CVE-2022-50706",
    "CVE-2023-52578",
    "CVE-2023-52594",
    "CVE-2023-52764",
    "CVE-2023-52835",
    "CVE-2023-52864",
    "CVE-2023-52885",
    "CVE-2023-53000",
    "CVE-2023-53039",
    "CVE-2023-53075",
    "CVE-2023-53077",
    "CVE-2023-53084",
    "CVE-2023-53090",
    "CVE-2023-53111",
    "CVE-2023-53116",
    "CVE-2023-53117",
    "CVE-2023-53145",
    "CVE-2023-53153",
    "CVE-2023-53259",
    "CVE-2023-53305",
    "CVE-2023-53307",
    "CVE-2023-53432",
    "CVE-2023-53484",
    "CVE-2023-53513",
    "CVE-2023-53668",
    "CVE-2023-53673",
    "CVE-2023-53676",
    "CVE-2023-54015",
    "CVE-2023-54072",
    "CVE-2023-54102",
    "CVE-2023-54148",
    "CVE-2024-26610",
    "CVE-2024-26872",
    "CVE-2024-26958",
    "CVE-2024-26961",
    "CVE-2024-26974",
    "CVE-2024-26982",
    "CVE-2024-27395",
    "CVE-2024-35855",
    "CVE-2024-35886",
    "CVE-2024-35937",
    "CVE-2024-36921",
    "CVE-2024-38538",
    "CVE-2024-38555",
    "CVE-2024-38586",
    "CVE-2024-38627",
    "CVE-2024-39487",
    "CVE-2024-40978",
    "CVE-2024-41042",
    "CVE-2024-42120",
    "CVE-2024-42292",
    "CVE-2024-43830",
    "CVE-2024-46815",
    "CVE-2024-56616",
    "CVE-2025-37749",
    "CVE-2025-37780",
    "CVE-2025-37797",
    "CVE-2025-37823",
    "CVE-2025-37839",
    "CVE-2025-37923",
    "CVE-2025-37927",
    "CVE-2025-38024",
    "CVE-2025-38051",
    "CVE-2025-38157",
    "CVE-2025-38180",
    "CVE-2025-38198",
    "CVE-2025-38212",
    "CVE-2025-38245",
    "CVE-2025-38323",
    "CVE-2025-38346",
    "CVE-2025-38403",
    "CVE-2025-38415",
    "CVE-2025-38556",
    "CVE-2025-38572",
    "CVE-2025-38574",
    "CVE-2025-38680",
    "CVE-2025-38702",
    "CVE-2025-38724",
    "CVE-2025-38729",
    "CVE-2025-39797",
    "CVE-2025-39853",
    "CVE-2025-39863",
    "CVE-2025-39955",
    "CVE-2025-39971",
    "CVE-2025-40154",
    "CVE-2025-40186",
    "CVE-2025-40248",
    "CVE-2025-40269",
    "CVE-2025-68349"
  );
  script_xref(name:"CLSA", value:"2026:1771078945");

  script_name(english:"CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1771078945)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.4:CLSA-2026:1771078945 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when
    initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct
    pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will
    increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via
    put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never
    incremented, can therefore free the init task's struct pid early. As there can be dangling references to
    the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted
    when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to
    struct pid in commit 9ec52099e4b8 ([PATCH] replace cad_pid by a struct pid) from the pre-KASAN stone age
    of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`.
    Full KASAN splat below. ================================================================== BUG: KASAN:
    use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in
    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-
    executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware
    name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline]
    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950
    exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8
    kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882
    [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by
    task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc
    mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180
    copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500
    kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687
    arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free
    mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8
    kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401
    proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48
    fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510
    fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585
    ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write
    fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall
    arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
    el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150
    arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416
    el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180
    arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to
    the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff
    ---truncated--- (CVE-2021-47118)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Don't generate an interrupt
    on bus reset Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to
    recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler
    (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling
    the end of a successful transaction. In the case of a block transaction, this can result in an out-of-
    range memory access. This condition was reproduced several times by syzbot:
    https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
    https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
    https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
    https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
    https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
    https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 So disable interrupts while trying to reset
    the bus. Interrupts will be enabled again for the following transaction. (CVE-2021-47153)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data
    Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer
    that gets written out. If this bit is set using commands like sg_write_same --ndob we will crash in
    target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because
    its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support
    it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal
    WRITE SAME with no data buffer. (CVE-2022-21546)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY
    interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues
    when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child
    interface uses the parent receive channels. Although the child shares the parent's receive channels, the
    number of rx queues is important for the channel_stats array: the parent's rx channel index is used to
    access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size
    for the counting to work correctly and to prevent out of bound accesses. This patch checks for the
    mentioned scenario and returns an error when trying to create the interface. The error is propagated to
    the user. (CVE-2022-48883)

  - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds
    access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we
    need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46
    ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/advisories/2026/clsa-2026_1771078945.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7ee32e83");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1771078945");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.4:CLSA-2026:1771078945.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39955");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.4', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '4',
    'pkgs': [
      {'reference':'bpftool-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-305.25.1.el8_4.tuxcare.els34', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}