Unity Linux 20.1070a Security Update: kernel (UTSA-2025-409873)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267870);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-41040");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-409873)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-409873 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Fix UAF when resolving a clash

    KASAN reports the following UAF:

     BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]
     Read of size 1 at addr ffff888c07603600 by task handler130/6469

     Call Trace:
      <IRQ>
      dump_stack_lvl+0x48/0x70
      print_address_description.constprop.0+0x33/0x3d0
      print_report+0xc0/0x2b0
      kasan_report+0xd0/0x120
      __asan_load1+0x6c/0x80
      tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]
      tcf_ct_act+0x886/0x1350 [act_ct]
      tcf_action_exec+0xf8/0x1f0
      fl_classify+0x355/0x360 [cls_flower]
      __tcf_classify+0x1fd/0x330
      tcf_classify+0x21c/0x3c0
      sch_handle_ingress.constprop.0+0x2c5/0x500
      __netif_receive_skb_core.constprop.0+0xb25/0x1510
      __netif_receive_skb_list_core+0x220/0x4c0
      netif_receive_skb_list_internal+0x446/0x620
      napi_complete_done+0x157/0x3d0
      gro_cell_poll+0xcf/0x100
      __napi_poll+0x65/0x310
      net_rx_action+0x30c/0x5c0
      __do_softirq+0x14f/0x491
      __irq_exit_rcu+0x82/0xc0
      irq_exit_rcu+0xe/0x20
      common_interrupt+0xa1/0xb0
      </IRQ>
      <TASK>
      asm_common_interrupt+0x27/0x40

     Allocated by task 6469:
      kasan_save_stack+0x38/0x70
      kasan_set_track+0x25/0x40
      kasan_save_alloc_info+0x1e/0x40
      __kasan_krealloc+0x133/0x190
      krealloc+0xaa/0x130
      nf_ct_ext_add+0xed/0x230 [nf_conntrack]
      tcf_ct_act+0x1095/0x1350 [act_ct]
      tcf_action_exec+0xf8/0x1f0
      fl_classify+0x355/0x360 [cls_flower]
      __tcf_classify+0x1fd/0x330
      tcf_classify+0x21c/0x3c0
      sch_handle_ingress.constprop.0+0x2c5/0x500
      __netif_receive_skb_core.constprop.0+0xb25/0x1510
      __netif_receive_skb_list_core+0x220/0x4c0
      netif_receive_skb_list_internal+0x446/0x620
      napi_complete_done+0x157/0x3d0
      gro_cell_poll+0xcf/0x100
      __napi_poll+0x65/0x310
      net_rx_action+0x30c/0x5c0
      __do_softirq+0x14f/0x491

     Freed by task 6469:
      kasan_save_stack+0x38/0x70
      kasan_set_track+0x25/0x40
      kasan_save_free_info+0x2b/0x60
      ____kasan_slab_free+0x180/0x1f0
      __kasan_slab_free+0x12/0x30
      slab_free_freelist_hook+0xd2/0x1a0
      __kmem_cache_free+0x1a2/0x2f0
      kfree+0x78/0x120
      nf_conntrack_free+0x74/0x130 [nf_conntrack]
      nf_ct_destroy+0xb2/0x140 [nf_conntrack]
      __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]
      nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]
      __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]
      tcf_ct_act+0x12ad/0x1350 [act_ct]
      tcf_action_exec+0xf8/0x1f0
      fl_classify+0x355/0x360 [cls_flower]
      __tcf_classify+0x1fd/0x330
      tcf_classify+0x21c/0x3c0
      sch_handle_ingress.constprop.0+0x2c5/0x500
      __netif_receive_skb_core.constprop.0+0xb25/0x1510
      __netif_receive_skb_list_core+0x220/0x4c0
      netif_receive_skb_list_internal+0x446/0x620
      napi_complete_done+0x157/0x3d0
      gro_cell_poll+0xcf/0x100
      __napi_poll+0x65/0x310
      net_rx_action+0x30c/0x5c0
      __do_softirq+0x14f/0x491

    The ct may be dropped if a clash has been resolved but is still passed to
    the tcf_ct_flow_table_process_conn function for further usage. This issue
    can be fixed by retrieving ct from skb again after confirming conntrack.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-409873
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75d808d5");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-41040");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-41040");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}