CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1780076591)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351748);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2019-17075",
    "CVE-2021-47191",
    "CVE-2021-47219",
    "CVE-2021-47288",
    "CVE-2021-47293",
    "CVE-2021-47309",
    "CVE-2021-47483",
    "CVE-2021-47541",
    "CVE-2021-47565",
    "CVE-2021-47576",
    "CVE-2021-47589",
    "CVE-2021-47600",
    "CVE-2025-71093",
    "CVE-2025-71116",
    "CVE-2026-23076",
    "CVE-2026-23193",
    "CVE-2026-23216",
    "CVE-2026-23388",
    "CVE-2026-31602",
    "CVE-2026-31778",
    "CVE-2026-43040",
    "CVE-2026-43206",
    "CVE-2026-46243"
  );
  script_xref(name:"CLSA", value:"2026:1780076591");

  script_name(english:"CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1780076591)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.5:CLSA-2026:1780076591 advisory.

  - An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel
    through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable.
    This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an
    architecture for which this stack/DMA interaction has security relevance. (CVE-2019-17075)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound
    read in resp_readcap16() The following warning was observed running syzkaller: [ 3813.830724] sg_write:
    data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor
    not setting count and/or reply_len properly [ 3813.836956]
    ================================================================== [ 3813.839465] BUG: KASAN: stack-out-
    of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task
    syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524]
    print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439]
    check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0
    [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [
    3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203]
    scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329]
    scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544]
    blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637]
    sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [
    3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841]
    do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This issue can be
    reproduced with the following syzkaller log: r0 = openat(0xffffffffffffff9c,
    &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff,
    &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 =
    syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB=00
    000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff61
    96a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d], 0x126) In resp_readcap16()
    we get int alloc_len value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but
    arr is only 32 bytes. This leads to OOB in sg_copy_buffer(). To solve this issue, define alloc_len as u32.
    (CVE-2021-47191)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix out-of-bound
    read in resp_report_tgtpgs() The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-
    bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in
    sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-
    executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware
    name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack
    lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118
    print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352
    [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy
    include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831
    fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770
    drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429
    scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0
    drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034
    __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484
    blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0
    drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0
    drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c
    vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599
    do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe We get
    'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
    Switch n, alen, and rlen to u32. (CVE-2021-47219)

  - In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in
    ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing
    the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning:
    '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject
    'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25:
    warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced
    subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the
    original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue
    FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because
    memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is
    FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also,
    the name of the function ngene_command_config_free_buf() suggests that the actual intention is to
    ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function
    ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct
    FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the
    destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps
    with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the
    FORTIFY_SOURCE routines on memcpy(). (CVE-2021-47288)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: Skip non-
    Ethernet packets Currently tcf_skbmod_act() assumes that packets use Ethernet as their L2 protocol, which
    is not always the case. As an example, for CAN devices: $ ip link add dev vcan0 type vcan $ ip link set up
    vcan0 $ tc qdisc add dev vcan0 root handle 1: htb $ tc filter add dev vcan0 parent 1: protocol ip prio 10
    \ matchall action skbmod swap mac Doing the above silently corrupts all the packets. Do not perform skbmod
    actions for non-Ethernet packets. (CVE-2021-47293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/advisories/2026/clsa-2026_1780076591.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f03dc0a5");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1780076591");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.5:CLSA-2026:1780076591.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-17075");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-23216");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.5([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.5', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '5',
    'pkgs': [
      {'reference':'bpftool-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-348.7.1.el8_5.tuxcare.els41', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}