Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-389728)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267066);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-42106");

  script_name(english:"Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-389728)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-389728 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: Initialize pad field in struct inet_diag_req_v2

    KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw
    sockets uses the pad field in struct inet_diag_req_v2 for the
    underlying protocol. This field corresponds to the sdiag_raw_protocol
    field in struct inet_diag_req_raw.

    inet_diag_get_exact_compat() converts inet_diag_req to
    inet_diag_req_v2, but leaves the pad field uninitialized. So the issue
    occurs when raw_lookup() accesses the sdiag_raw_protocol field.

    Fix this by initializing the pad field in
    inet_diag_get_exact_compat(). Also, do the same fix in
    inet_diag_dump_compat() to avoid the similar issue in the future.

    [1]
    BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline]
    BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71
     raw_lookup net/ipv4/raw_diag.c:49 [inline]
     raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71
     raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99
     inet_diag_cmd_exact+0x7d9/0x980
     inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline]
     inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426
     sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282
     netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564
     sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297
     netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
     netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361
     netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905
     sock_sendmsg_nosec net/socket.c:730 [inline]
     __sock_sendmsg+0x332/0x3d0 net/socket.c:745
     ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585
     ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639
     __sys_sendmsg net/socket.c:2668 [inline]
     __do_sys_sendmsg net/socket.c:2677 [inline]
     __se_sys_sendmsg net/socket.c:2675 [inline]
     __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675
     x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Uninit was stored to memory at:
     raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71
     raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99
     inet_diag_cmd_exact+0x7d9/0x980
     inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline]
     inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426
     sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282
     netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564
     sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297
     netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
     netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361
     netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905
     sock_sendmsg_nosec net/socket.c:730 [inline]
     __sock_sendmsg+0x332/0x3d0 net/socket.c:745
     ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585
     ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639
     __sys_sendmsg net/socket.c:2668 [inline]
     __do_sys_sendmsg net/socket.c:2677 [inline]
     __se_sys_sendmsg net/socket.c:2675 [inline]
     __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675
     x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Local variable req.i created at:
     inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline]
     inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426
     sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282

    CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-389728
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?336414fa");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-42106");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-42106");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a|20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a / 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.2', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.34', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}