Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-382521)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267100);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-45003");

  script_name(english:"Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-382521)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-382521 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vfs: Don't evict inode under the inode lru traversing context

    The inode reclaiming process(See function prune_icache_sb) collects all
    reclaimable inodes and mark them with I_FREEING flag at first, at that
    time, other processes will be stuck if they try getting these inodes
    (See function find_inode_fast), then the reclaiming process destroy the
    inodes by function dispose_list(). Some filesystems(eg. ext4 with
    ea_inode feature, ubifs with xattr) may do inode lookup in the inode
    evicting callback function, if the inode lookup is operated under the
    inode lru traversing context, deadlock problems may happen.

    Case 1: In function ext4_evict_inode(), the ea inode lookup could happen
            if ea_inode feature is enabled, the lookup process will be stuck
            under the evicting context like this:

     1. File A has inode i_reg and an ea inode i_ea
     2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea
     3. Then, following three processes running like this:

        PA                              PB
     echo 2 > /proc/sys/vm/drop_caches
      shrink_slab
       prune_dcache_sb
       // i_reg is added into lru, lru->i_ea->i_reg
       prune_icache_sb
        list_lru_walk_one
         inode_lru_isolate
          i_ea->i_state |= I_FREEING // set inode state
         inode_lru_isolate
          __iget(i_reg)
          spin_unlock(&i_reg->i_lock)
          spin_unlock(lru_lock)
                                         rm file A
                                          i_reg->nlink = 0
          iput(i_reg) // i_reg->nlink is 0, do evict
           ext4_evict_inode
            ext4_xattr_delete_inode
             ext4_xattr_inode_dec_ref_all
              ext4_xattr_inode_iget
               ext4_iget(i_ea->i_ino)
                iget_locked
                 find_inode_fast
                  __wait_on_freeing_inode(i_ea) ---- AA deadlock
        dispose_list // cannot be executed by prune_icache_sb
         wake_up_bit(&i_ea->i_state)

    Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file
            deleting process holds BASEHD's wbuf->io_mutex while getting the
            xattr inode, which could race with inode reclaiming process(The
            reclaiming process could try locking BASEHD's wbuf->io_mutex in
            inode evicting function), then an ABBA deadlock problem would
            happen as following:

     1. File A has inode ia and a xattr(with inode ixa), regular file B has
        inode ib and a xattr.
     2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa
     3. Then, following three processes running like this:

            PA                PB                        PC
                    echo 2 > /proc/sys/vm/drop_caches
                     shrink_slab
                      prune_dcache_sb
                      // ib and ia are added into lru, lru->ixa->ib->ia
                      prune_icache_sb
                       list_lru_walk_one
                        inode_lru_isolate
                         ixa->i_state |= I_FREEING // set inode state
                        inode_lru_isolate
                         __iget(ib)
                         spin_unlock(&ib->i_lock)
                         spin_unlock(lru_lock)
                                                       rm file B
                                                        ib->nlink = 0
     rm file A
      iput(ia)
       ubifs_evict_inode(ia)
        ubifs_jnl_delete_inode(ia)
         ubifs_jnl_write_inode(ia)
          make_reservation(BASEHD) // Lock wbuf->io_mutex
          ubifs_iget(ixa->i_ino)
           iget_locked
            find_inode_fast
             __wait_on_freeing_inode(ixa)
              |          iput(ib) // ib->nlink is 0, do evict
              |           ubifs_evict_inode
              |            ubifs_jnl_delete_inode(ib)
                           ubifs_jnl_write_inode
         ABBA deadlock -----make_reservation(BASEHD)
                       dispose_list // cannot be executed by prune_icache_sb
                        wake_up_bit(&ixa->i_state)

    Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING
    to pin the inode in memory while inode_lru_isolate(
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-382521
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1fe939a1");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-45003");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-45003");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a|20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a / 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}