CentOS Linux 8.5 [TuxCare] Security Update: kernel-cross-headers / kernel-debug-modules-extra / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1749562017)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352664);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2022-48991",
    "CVE-2022-49290",
    "CVE-2022-49410",
    "CVE-2022-49416",
    "CVE-2022-49478",
    "CVE-2022-49508",
    "CVE-2022-49530",
    "CVE-2023-52988",
    "CVE-2025-21780",
    "CVE-2025-37785"
  );
  script_xref(name:"CLSA", value:"2025:1749562017");

  script_name(english:"CentOS Linux 8.5 [TuxCare] Security Update: kernel-cross-headers / kernel-debug-modules-extra / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1749562017)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.5:CLSA-2025:1749562017 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in
    shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure
    that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs
    don't hold their own references to pages that are mirrored over, so failing to notify them can lead to
    page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b
    (khugepaged: add support of collapse for tmpfs/shmem pages), but most of the security impact of this
    only came in commit 27e1f8273113 (khugepaged: enable collapse pmd for pte-mapped THP), which actually
    omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
    (CVE-2022-48991)

  - In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on
    mesh join While commit 6a01afcf8468 (mac80211: mesh: Free ie data when leaving mesh) fixed a memory leak
    on mesh leave / teardown it introduced a potential memory corruption caused by a double free when
    rejoining the mesh: ieee80211_leave_mesh() -> kfree(sdata->u.mesh.ie); ... ieee80211_join_mesh() ->
    copy_mesh_setup() -> old_ie = ifmsh->ie; -> kfree(old_ie); This double free / kernel panics can be
    reproduced by using wpa_supplicant with an encrypted mesh (if set up without encryption via iw then
    ifmsh->ie is always NULL, which avoids this issue). And then calling: $ iw dev mesh0 mesh leave $ iw dev
    mesh0 mesh join my-mesh Note that typically these commands are not used / working when using
    wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going through a NETDEV_DOWN/NETDEV_UP
    cycle between a mesh leave and mesh join where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of
    default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids the memory corruption, too. The
    issue was first observed in an application which was not using wpa_supplicant but Senf instead, which
    implements its own calls to nl80211. Fixing the issue by removing the kfree()'ing of the mesh IE in the
    mesh join function and leaving it solely up to the mesh leave to free the mesh IE. (CVE-2022-49290)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in
    create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable
    ref_field, which is allocated in the previous function call to create_hist_field(). Function
    init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when
    the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling,
    which frees the fields and the variable itself. This results in double free of the fields which are
    already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are
    freed in init_var_ref(). (CVE-2022-49410)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in
    chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's
    replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in
    ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it
    to NULL after this point. However, since the new_ctx replace state is clearly not
    IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return
    to avoid accessing the freed old_ctx. (CVE-2022-49416)

  - In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-
    of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing
    validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value
    remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the
    easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
    (CVE-2022-49478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/advisories/2025/clsa-2025_1749562017.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ef6796d");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2025:1749562017");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.5:CLSA-2025:1749562017.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21780");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.5([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.5', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '5',
    'pkgs': [
      {'reference':'kernel-cross-headers-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-348.7.1.el8_5.tuxcare.els28', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-cross-headers / kernel-debug-modules-extra / etc');
}