CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1786435880)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(361958);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2021-47012",
    "CVE-2022-49667",
    "CVE-2025-21762",
    "CVE-2026-43233",
    "CVE-2026-43334",
    "CVE-2026-43339",
    "CVE-2026-46234",
    "CVE-2026-53064",
    "CVE-2026-53112",
    "CVE-2026-64561"
  );
  script_xref(name:"CLSA", value:"2026:1786435880");

  script_name(english:"CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1786435880)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.4:CLSA-2026:1786435880 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in
    siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the
    implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if
    xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to
    the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). My patch moves
    mr->mem = mem behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf. (CVE-2021-47012)

  - In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after
    802.3ad slave unbind commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection), resolve case,
    when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear)
    aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when
    num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator.
    NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So,
    here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in
    group (as was before commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection) ), before
    ad_clear_agg(). The KASAN logs are as follows: [ 767.617392]
    ================================================================== [ 767.630776] BUG: KASAN: use-after-
    free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430
    by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [
    767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1
    bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [
    767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659]
    print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148]
    __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 (CVE-2022-49667)

  - In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit()
    arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
    (CVE-2025-21762)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB
    read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`,
    which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ...
    if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here
    */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed
    (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
    which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of
    the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered
    remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly
    2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323
    helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a
    1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the
    maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at
    every other get_len() call site in the same file, where the caller checks for 2 bytes of available data
    before calling get_len(). (CVE-2026-43233)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM
    requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing
    response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the
    initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires
    MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method
    selection inconsistent with the pairing policy the responder already enforces. When the local side
    requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force
    SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later
    method selection aligned. (CVE-2026-43334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/advisories/2026/clsa-2026_1786435880.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5aec418c");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1786435880");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.4:CLSA-2026:1786435880.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53112");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.4', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '4',
    'pkgs': [
      {'reference':'bpftool-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-305.25.1.el8_4.tuxcare.els46', 'sp':'4', 'cpu':'x86_64', 'el_string':'el8_4', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}