Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-388913)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266794);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-35990");

  script_name(english:"Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-388913)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-388913 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dma: xilinx_dpdma: Fix locking

    There are several places where either chan->lock or chan->vchan.lock was
    not held. Add appropriate locking. This fixes lockdep warnings like

    [   31.077578] ------------[ cut here ]------------
    [   31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834
    xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
    [   31.077953] Modules linked in:
    [   31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98
    [   31.078102] Hardware name: xlnx,zynqmp (DT)
    [   31.078169] Workqueue: events_unbound deferred_probe_work_func
    [   31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [   31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
    [   31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0
    [   31.078550] sp : ffffffc083bb2e10
    [   31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168
    [   31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480
    [   31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000
    [   31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000
    [   31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
    [   31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001
    [   31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def
    [   31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516
    [   31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff
    [   31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000
    [   31.080307] Call trace:
    [   31.080340]  xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
    [   31.080518]  xilinx_dpdma_issue_pending+0x11c/0x120
    [   31.080595]  zynqmp_disp_layer_update+0x180/0x3ac
    [   31.080712]  zynqmp_dpsub_plane_atomic_update+0x11c/0x21c
    [   31.080825]  drm_atomic_helper_commit_planes+0x20c/0x684
    [   31.080951]  drm_atomic_helper_commit_tail+0x5c/0xb0
    [   31.081139]  commit_tail+0x234/0x294
    [   31.081246]  drm_atomic_helper_commit+0x1f8/0x210
    [   31.081363]  drm_atomic_commit+0x100/0x140
    [   31.081477]  drm_client_modeset_commit_atomic+0x318/0x384
    [   31.081634]  drm_client_modeset_commit_locked+0x8c/0x24c
    [   31.081725]  drm_client_modeset_commit+0x34/0x5c
    [   31.081812]  __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168
    [   31.081899]  drm_fb_helper_set_par+0x50/0x70
    [   31.081971]  fbcon_init+0x538/0xc48
    [   31.082047]  visual_init+0x16c/0x23c
    [   31.082207]  do_bind_con_driver.isra.0+0x2d0/0x634
    [   31.082320]  do_take_over_console+0x24c/0x33c
    [   31.082429]  do_fbcon_takeover+0xbc/0x1b0
    [   31.082503]  fbcon_fb_registered+0x2d0/0x34c
    [   31.082663]  register_framebuffer+0x27c/0x38c
    [   31.082767]  __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c
    [   31.082939]  drm_fb_helper_initial_config+0x50/0x74
    [   31.083012]  drm_fbdev_dma_client_hotplug+0xb8/0x108
    [   31.083115]  drm_client_register+0xa0/0xf4
    [   31.083195]  drm_fbdev_dma_setup+0xb0/0x1cc
    [   31.083293]  zynqmp_dpsub_drm_init+0x45c/0x4e0
    [   31.083431]  zynqmp_dpsub_probe+0x444/0x5e0
    [   31.083616]  platform_probe+0x8c/0x13c
    [   31.083713]  really_probe+0x258/0x59c
    [   31.083793]  __driver_probe_device+0xc4/0x224
    [   31.083878]  driver_probe_device+0x70/0x1c0
    [   31.083961]  __device_attach_driver+0x108/0x1e0
    [   31.084052]  bus_for_each_drv+0x9c/0x100
    [   31.084125]  __device_attach+0x100/0x298
    [   31.084207]  device_initial_probe+0x14/0x20
    [   31.084292]  bus_probe_device+0xd8/0xdc
    [   31.084368]  deferred_probe_work_func+0x11c/0x180
    [   31.084451]  process_one_work+0x3ac/0x988
    [   31.084643]  worker_thread+0x398/0x694
    [   31.084752]  kthread+0x1bc/0x1c0
    [   31.084848]  ret_from_fork+0x10/0x20
    [   31.084932] irq event stamp: 64549
    [   31.084970] hardirqs last  enabled at (64548): [<ffffffc081adf35c>]
    _raw_spin_unlock_irqrestore+0x80/0x90
    [   31.085157]
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-388913
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8c7b5ce1");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-35990");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-35990");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a|20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a / 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}