CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1763722365)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352377);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2022-49985",
    "CVE-2022-50367",
    "CVE-2022-50386",
    "CVE-2023-52530",
    "CVE-2023-52679",
    "CVE-2023-52764",
    "CVE-2023-52775",
    "CVE-2023-52847",
    "CVE-2023-52864",
    "CVE-2023-52884",
    "CVE-2023-53125",
    "CVE-2023-53178",
    "CVE-2023-53226",
    "CVE-2023-53257",
    "CVE-2023-53305",
    "CVE-2023-53373",
    "CVE-2024-26739",
    "CVE-2024-26958",
    "CVE-2024-26961",
    "CVE-2024-27395",
    "CVE-2024-35937",
    "CVE-2024-35939",
    "CVE-2024-36015",
    "CVE-2024-36880",
    "CVE-2024-36921",
    "CVE-2024-38556",
    "CVE-2024-38586",
    "CVE-2024-38601",
    "CVE-2024-38635",
    "CVE-2024-38659",
    "CVE-2024-39487",
    "CVE-2024-40927",
    "CVE-2024-40978",
    "CVE-2024-42119",
    "CVE-2024-42292",
    "CVE-2024-46713",
    "CVE-2024-46754",
    "CVE-2024-50038",
    "CVE-2024-52332",
    "CVE-2024-53214",
    "CVE-2024-56539",
    "CVE-2024-56570",
    "CVE-2024-56594",
    "CVE-2024-56616",
    "CVE-2024-57876",
    "CVE-2024-57904",
    "CVE-2024-57929",
    "CVE-2024-58014",
    "CVE-2024-58072",
    "CVE-2025-21704",
    "CVE-2025-21772",
    "CVE-2025-22121",
    "CVE-2025-37796",
    "CVE-2025-37797",
    "CVE-2025-38001",
    "CVE-2025-38392",
    "CVE-2025-38461",
    "CVE-2025-38498",
    "CVE-2025-38527",
    "CVE-2025-38556",
    "CVE-2025-38718",
    "CVE-2025-39730",
    "CVE-2025-39757",
    "CVE-2025-39817",
    "CVE-2025-39864"
  );
  script_xref(name:"CLSA", value:"2025:1763722365");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1763722365)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2025:1763722365 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array
    range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer
    which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in
    bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU:
    1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX,
    1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x9c/0xc9
    print_address_description.constprop.0+0x1f/0x1f0 ? bpf_int_jit_compile+0x1257/0x13f0
    kasan_report.cold+0xeb/0x197 ? kvmalloc_node+0x170/0x200 ? bpf_int_jit_compile+0x1257/0x13f0
    bpf_int_jit_compile+0x1257/0x13f0 ? arch_prepare_bpf_dispatcher+0xd0/0xd0 ?
    rcu_read_lock_sched_held+0x43/0x70 bpf_prog_select_runtime+0x3e8/0x640 ? bpf_obj_name_cpy+0x149/0x1b0
    bpf_prog_load+0x102f/0x2220 ? __bpf_prog_put.constprop.0+0x220/0x220 ? find_held_lock+0x2c/0x110 ?
    __might_fault+0xd6/0x180 ? lock_downgrade+0x6e0/0x6e0 ? lock_is_held_type+0xa6/0x120 ?
    __might_fault+0x147/0x180 __sys_bpf+0x137b/0x6070 ? bpf_perf_link_attach+0x530/0x530 ?
    new_sync_read+0x600/0x600 ? __fget_files+0x255/0x450 ? lock_downgrade+0x6e0/0x6e0 ? fput+0x30/0x1a0 ?
    ksys_write+0x1a8/0x260 __x64_sys_bpf+0x7a/0xc0 ? syscall_enter_from_user_mode+0x21/0x70
    do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f917c4e2c2d The problem here
    is that a range of tnum_range(0, map->max_entries - 1) has limited ability to represent the concrete tight
    range with the tnum as the set of resulting states from value + mask can result in a superset of the
    actual intended range, and as such a tnum_in(range, reg->var_off) check may yield true when it shouldn't,
    for example tnum_range(0, 2) would result in 00XX -> v = 0000, m = 0011 such that the intended set of {0,
    1, 2} is here represented by a less precise superset of {0, 1, 2, 3}. As the register is known const
    scalar, really just use the concrete reg->var_off.value for the upper index check. (CVE-2022-49985)

  - In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in
    nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc()
    fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and
    nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and
    leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to
    this_cpu_inc(nr_inodes) (CVE-2022-50367)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free
    This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following
    trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan
    0000000023c4974d Bluetooth: parent 00000000ae861c08
    ================================================================== BUG: KASAN: use-after-free in
    __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
    __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
    __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task
    kworker/u3:2/389 (CVE-2022-50386)

  - In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in
    of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through
    the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the
    inner loop. This assumes that the value of new is NULL on the first iteration of the inner loop. Make
    sure that this is true in all iterations of the outer loop by setting new to NULL after its value is
    assigned to cur. Extend the unittest to detect the double free and add an additional test case that
    actually triggers this path. (CVE-2023-52679)

  - In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-
    bounds in set_flicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in
    drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the
    value of the variable sd->params.exposure.gain exceeds the number of bits in an integer, a shift-out-of-
    bounds error is reported. It is triggered because the variable currentexp cannot be left-shifted by more
    than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional
    expression is added. (CVE-2023-52764)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2025/clsa-2025_1763722365.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fbc47d6e");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2025:1763722365");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2025:1763722365.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50386");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'bpftool-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-553.6.1.el8_10.tuxcare.els14', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}