Unity Linux 20.1070a Security Update: kernel (UTSA-2025-401671)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267567);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-36886");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-401671)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-401671 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix UAF in error path

    Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported
    a UAF in the tipc_buf_append() error path:

    BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0
    linux/net/core/skbuff.c:1183
    Read of size 8 at addr ffff88804d2a7c80 by task poc/8034

    CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    1.16.0-debian-1.16.0-5 04/01/2014
    Call Trace:
     <IRQ>
     __dump_stack linux/lib/dump_stack.c:88
     dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106
     print_address_description linux/mm/kasan/report.c:377
     print_report+0xc4/0x620 linux/mm/kasan/report.c:488
     kasan_report+0xda/0x110 linux/mm/kasan/report.c:601
     kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183
     skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026
     skb_release_all linux/net/core/skbuff.c:1094
     __kfree_skb linux/net/core/skbuff.c:1108
     kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144
     kfree_skb linux/./include/linux/skbuff.h:1244
     tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186
     tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324
     tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824
     tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159
     tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390
     udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108
     udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186
     udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346
     __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422
     ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205
     ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233
     NF_HOOK linux/./include/linux/netfilter.h:314
     NF_HOOK linux/./include/linux/netfilter.h:308
     ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254
     dst_input linux/./include/net/dst.h:461
     ip_rcv_finish linux/net/ipv4/ip_input.c:449
     NF_HOOK linux/./include/linux/netfilter.h:314
     NF_HOOK linux/./include/linux/netfilter.h:308
     ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569
     __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534
     __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648
     process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976
     __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576
     napi_poll linux/net/core/dev.c:6645
     net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781
     __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553
     do_softirq linux/kernel/softirq.c:454
     do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441
     </IRQ>
     <TASK>
     __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381
     local_bh_enable linux/./include/linux/bottom_half.h:33
     rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851
     __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378
     dev_queue_xmit linux/./include/linux/netdevice.h:3169
     neigh_hh_output linux/./include/net/neighbour.h:526
     neigh_output linux/./include/net/neighbour.h:540
     ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235
     __ip_finish_output linux/net/ipv4/ip_output.c:313
     __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295
     ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323
     NF_HOOK_COND linux/./include/linux/netfilter.h:303
     ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433
     dst_output linux/./include/net/dst.h:451
     ip_local_out linux/net/ipv4/ip_output.c:129
     ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492
     udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963
     udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250
     inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850
     sock_sendmsg_nosec linux/net/socket.c:730
     __sock_sendmsg linux/net/socket.c:745
     __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191
     __do_sys_sendto linux/net/socket.c:2203
     __se_sys_sendto linux/net/socket.c:2199
     __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199
     do_syscall_x64 linux/arch/x86/entry/common.c:52
     do_syscall_
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-401671
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e72e73ea");
  # https://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36886-dd83@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8938879a");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-36886");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-36886");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}