CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1786436146)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(361319);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2024-26589",
    "CVE-2026-43233",
    "CVE-2026-43334",
    "CVE-2026-43339",
    "CVE-2026-46234",
    "CVE-2026-53112",
    "CVE-2026-64561"
  );
  script_xref(name:"CLSA", value:"2026:1786436146");

  script_name(english:"CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1786436146)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.5:CLSA-2026:1786436146 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on
    PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation.
    However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not
    checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx()
    R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3:
    (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
    smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5
    first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise:
    frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 =
    1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400))
    R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0)
    ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and
    finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...]
    Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run
    include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline]
    bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350
    net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
    bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
    __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
    __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by
    rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with R7
    pointer arithmetic on flow_keys prohibited. (CVE-2024-26589)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB
    read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`,
    which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ...
    if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here
    */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed
    (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
    which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of
    the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered
    remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly
    2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323
    helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a
    1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the
    maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at
    every other get_len() call site in the same file, where the caller checks for 2 bytes of available data
    before calling get_len(). (CVE-2026-43233)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM
    requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing
    response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the
    initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires
    MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method
    selection inconsistent with the pairing policy the responder already enforces. When the local side
    requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force
    SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later
    method selection aligned. (CVE-2026-43334)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in
    addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but
    the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement
    to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no
    protection. (CVE-2026-43339)

  - In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order
    In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the
    minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the
    maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the
    vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this by checking the minimum
    first, and then the maximum. This ensures the buffer size never exceeds the buffer_max_size.
    (CVE-2026-46234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/advisories/2026/clsa-2026_1786436146.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1cff43f0");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1786436146");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.5:CLSA-2026:1786436146.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53112");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/02/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.5([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.5', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '5',
    'pkgs': [
      {'reference':'bpftool-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-348.7.1.el8_5.tuxcare.els46', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}