Unity Linux 20.1070a Security Update: kernel (UTSA-2025-411488)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(267381);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2024-26961");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-411488)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-411488 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix llsec key resources release in mac802154_llsec_key_del

    mac802154_llsec_key_del() can free resources of a key directly without
    following the RCU rules for waiting before the end of a grace period. This
    may lead to use-after-free in case llsec_lookup_key() is traversing the
    list of keys in parallel with a key deletion:

    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0
    Modules linked in:
    CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
    RIP: 0010:refcount_warn_saturate+0x162/0x2a0
    Call Trace:
     <TASK>
     llsec_lookup_key.isra.0+0x890/0x9e0
     mac802154_llsec_encrypt+0x30c/0x9c0
     ieee802154_subif_start_xmit+0x24/0x1e0
     dev_hard_start_xmit+0x13e/0x690
     sch_direct_xmit+0x2ae/0xbc0
     __dev_queue_xmit+0x11dd/0x3c20
     dgram_sendmsg+0x90b/0xd60
     __sys_sendto+0x466/0x4c0
     __x64_sys_sendto+0xe0/0x1c0
     do_syscall_64+0x45/0xf0
     entry_SYSCALL_64_after_hwframe+0x6e/0x76

    Also, ieee802154_llsec_key_entry structures are not freed by
    mac802154_llsec_key_del():

    unreferenced object 0xffff8880613b6980 (size 64):
      comm iwpan, pid 2176, jiffies 4294761134 (age 60.475s)
      hex dump (first 32 bytes):
        78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x..............
        00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................
      backtrace:
        [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0
        [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0
        [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0
        [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80
        [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0
        [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0
        [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0
        [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440
        [<ffffffff86ff1d88>] genl_rcv+0x28/0x40
        [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820
        [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60
        [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0
        [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0
        [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0
        [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0
        [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

    Handle the proper resource release in the RCU callback function
    mac802154_llsec_key_del_rcu().

    Note that if llsec_lookup_key() finds a key, it gets a refcount via
    llsec_key_get() and locally copies key id from key_entry (which is a
    list element). So it's safe to call llsec_key_put() and free the list
    entry after the RCU grace period elapses.

    Found by Linux Verification Center (linuxtesting.org).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-411488
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?00bd942c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-26961");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-26961");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.12', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}