Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987686)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271082);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/21");

  script_cve_id("CVE-2022-49740");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987686)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-987686 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads

    This patch fixes slab-out-of-bounds reads in brcmfmac that occur in
    brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count
    value of channel specifications provided by the device is greater than
    the length of 'list->element[]', decided by the size of the 'list'
    allocated with kzalloc(). The patch adds checks that make the functions
    free the buffer and return -EINVAL if that is the case. Note that the
    negative return is handled by the caller, brcmf_setup_wiphybands() or
    brcmf_cfg80211_attach().

    Found by a modified version of syzkaller.

    Crash Report from brcmf_construct_chaninfo():
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430
    Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896

    CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org
    04/01/2014
    Workqueue: usb_hub_wq hub_event
    Call Trace:
     dump_stack_lvl+0x57/0x7d
     print_address_description.constprop.0.cold+0x93/0x334
     kasan_report.cold+0x83/0xdf
     brcmf_setup_wiphybands+0x1238/0x1430
     brcmf_cfg80211_attach+0x2118/0x3fd0
     brcmf_attach+0x389/0xd40
     brcmf_usb_probe+0x12de/0x1690
     usb_probe_interface+0x25f/0x710
     really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460
     driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250
     bus_for_each_drv+0x123/0x1a0
     __device_attach+0x207/0x330
     bus_probe_device+0x1a2/0x260
     device_add+0xa61/0x1ce0
     usb_set_configuration+0x984/0x1770
     usb_generic_driver_probe+0x69/0x90
     usb_probe_device+0x9c/0x220
     really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460
     driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250
     bus_for_each_drv+0x123/0x1a0
     __device_attach+0x207/0x330
     bus_probe_device+0x1a2/0x260
     device_add+0xa61/0x1ce0
     usb_new_device.cold+0x463/0xf66
     hub_event+0x10d5/0x3330
     process_one_work+0x873/0x13e0
     worker_thread+0x8b/0xd10
     kthread+0x379/0x450
     ret_from_fork+0x1f/0x30

    Allocated by task 1896:
     kasan_save_stack+0x1b/0x40
     __kasan_kmalloc+0x7c/0x90
     kmem_cache_alloc_trace+0x19e/0x330
     brcmf_setup_wiphybands+0x290/0x1430
     brcmf_cfg80211_attach+0x2118/0x3fd0
     brcmf_attach+0x389/0xd40
     brcmf_usb_probe+0x12de/0x1690
     usb_probe_interface+0x25f/0x710
     really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460
     driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250
     bus_for_each_drv+0x123/0x1a0
     __device_attach+0x207/0x330
     bus_probe_device+0x1a2/0x260
     device_add+0xa61/0x1ce0
     usb_set_configuration+0x984/0x1770
     usb_generic_driver_probe+0x69/0x90
     usb_probe_device+0x9c/0x220
     really_probe+0x1be/0xa90
     __driver_probe_device+0x2ab/0x460
     driver_probe_device+0x49/0x120
     __device_attach_driver+0x18a/0x250
     bus_for_each_drv+0x123/0x1a0
     __device_attach+0x207/0x330
     bus_probe_device+0x1a2/0x260
     device_add+0xa61/0x1ce0
     usb_new_device.cold+0x463/0xf66
     hub_event+0x10d5/0x3330
     process_one_work+0x873/0x13e0
     worker_thread+0x8b/0xd10
     kthread+0x379/0x450
     ret_from_fork+0x1f/0x30

    The buggy address belongs to the object at ffff888115f24000
     which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 1536 bytes inside of
     2048-byte region [ffff888115f24000, ffff888115f24800)

    Memory state around the buggy address:
     ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
     ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ==================================================================

    Crash Report from brcmf_enable_bw40_2g():
    ==========
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-987686
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f7edb7dd");
  # https://lore.kernel.org/linux-cve-announce/2025032757-CVE-2022-49740-7f6e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8796059c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49740");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49740");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.15', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.15', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.15', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}