Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986403)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(268962);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2022-48919");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986403)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-986403 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix double free race when mount fails in cifs_get_root()

    When cifs_get_root() fails during cifs_smb3_do_mount() we call
    deactivate_locked_super() which eventually will call delayed_free() which
    will free the context.
    In this situation we should not proceed to enter the out: section in
    cifs_smb3_do_mount() and free the same resources a second time.

    [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60
    [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0

    [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           OE     5.17.0-rc3+ #4
    [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS
    Hyper-V UEFI Release v4.0 12/17/2019
    [Thu Feb 10 12:59:06 2022] Call Trace:
    [Thu Feb 10 12:59:06 2022]  <IRQ>
    [Thu Feb 10 12:59:06 2022]  dump_stack_lvl+0x5d/0x78
    [Thu Feb 10 12:59:06 2022]  print_address_description.constprop.0+0x24/0x150
    [Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60
    [Thu Feb 10 12:59:06 2022]  kasan_report.cold+0x7d/0x117
    [Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60
    [Thu Feb 10 12:59:06 2022]  __asan_load8+0x86/0xa0
    [Thu Feb 10 12:59:06 2022]  rcu_cblist_dequeue+0x32/0x60
    [Thu Feb 10 12:59:06 2022]  rcu_core+0x547/0xca0
    [Thu Feb 10 12:59:06 2022]  ? call_rcu+0x3c0/0x3c0
    [Thu Feb 10 12:59:06 2022]  ? __this_cpu_preempt_check+0x13/0x20
    [Thu Feb 10 12:59:06 2022]  ? lock_is_held_type+0xea/0x140
    [Thu Feb 10 12:59:06 2022]  rcu_core_si+0xe/0x10
    [Thu Feb 10 12:59:06 2022]  __do_softirq+0x1d4/0x67b
    [Thu Feb 10 12:59:06 2022]  __irq_exit_rcu+0x100/0x150
    [Thu Feb 10 12:59:06 2022]  irq_exit_rcu+0xe/0x30
    [Thu Feb 10 12:59:06 2022]  sysvec_hyperv_stimer0+0x9d/0xc0
    ...
    [Thu Feb 10 12:59:07 2022] Freed by task 58179:
    [Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50
    [Thu Feb 10 12:59:07 2022]  kasan_set_track+0x25/0x30
    [Thu Feb 10 12:59:07 2022]  kasan_set_free_info+0x24/0x40
    [Thu Feb 10 12:59:07 2022]  ____kasan_slab_free+0x137/0x170
    [Thu Feb 10 12:59:07 2022]  __kasan_slab_free+0x12/0x20
    [Thu Feb 10 12:59:07 2022]  slab_free_freelist_hook+0xb3/0x1d0
    [Thu Feb 10 12:59:07 2022]  kfree+0xcd/0x520
    [Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0x149/0xbe0 [cifs]
    [Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]
    [Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140
    [Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0
    [Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210
    [Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0
    [Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae

    [Thu Feb 10 12:59:07 2022] Last potentially related work creation:
    [Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50
    [Thu Feb 10 12:59:07 2022]  __kasan_record_aux_stack+0xb6/0xc0
    [Thu Feb 10 12:59:07 2022]  kasan_record_aux_stack_noalloc+0xb/0x10
    [Thu Feb 10 12:59:07 2022]  call_rcu+0x76/0x3c0
    [Thu Feb 10 12:59:07 2022]  cifs_umount+0xce/0xe0 [cifs]
    [Thu Feb 10 12:59:07 2022]  cifs_kill_sb+0xc8/0xe0 [cifs]
    [Thu Feb 10 12:59:07 2022]  deactivate_locked_super+0x5d/0xd0
    [Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0xab9/0xbe0 [cifs]
    [Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]
    [Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140
    [Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0
    [Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210
    [Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0
    [Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-986403
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a03519a5");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-48919");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-48919");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.190.002', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.002', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.002', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.002', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}