Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988688)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273295);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2022-49194");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988688)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-988688 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: bcmgenet: Use stronger register read/writes to assure ordering

    GCC12 appears to be much smarter about its dependency tracking and is
    aware that the relaxed variants are just normal loads and stores and
    this is causing problems like:

    [  210.074549] ------------[ cut here ]------------
    [  210.079223] NETDEV WATCHDOG: enabcm6e4ei0 (bcmgenet): transmit queue 1 timed out
    [  210.086717] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:529 dev_watchdog+0x234/0x240
    [  210.095044] Modules linked in: genet(E) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet
    nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat]
    [  210.146561] ACPI CPPC: PCC check channel failed for ss: 0. ret=-110
    [  210.146927] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E     5.17.0-rc7G12+ #58
    [  210.153226] CPPC Cpufreq:cppc_scale_freq_workfn: failed to read perf counters
    [  210.161349] Hardware name: Raspberry Pi Foundation Raspberry Pi 4 Model B/Raspberry Pi 4 Model B, BIOS
    EDK2-DEV 02/08/2022
    [  210.161353] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [  210.161358] pc : dev_watchdog+0x234/0x240
    [  210.161364] lr : dev_watchdog+0x234/0x240
    [  210.161368] sp : ffff8000080a3a40
    [  210.161370] x29: ffff8000080a3a40 x28: ffffcd425af87000 x27: ffff8000080a3b20
    [  210.205150] x26: ffffcd425aa00000 x25: 0000000000000001 x24: ffffcd425af8ec08
    [  210.212321] x23: 0000000000000100 x22: ffffcd425af87000 x21: ffff55b142688000
    [  210.219491] x20: 0000000000000001 x19: ffff55b1426884c8 x18: ffffffffffffffff
    [  210.226661] x17: 64656d6974203120 x16: 0000000000000001 x15: 6d736e617274203a
    [  210.233831] x14: 2974656e65676d63 x13: ffffcd4259c300d8 x12: ffffcd425b07d5f0
    [  210.241001] x11: 00000000ffffffff x10: ffffcd425b07d5f0 x9 : ffffcd4258bdad9c
    [  210.248171] x8 : 00000000ffffdfff x7 : 000000000000003f x6 : 0000000000000000
    [  210.255341] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000001000
    [  210.262511] x2 : 0000000000001000 x1 : 0000000000000005 x0 : 0000000000000044
    [  210.269682] Call trace:
    [  210.272133]  dev_watchdog+0x234/0x240
    [  210.275811]  call_timer_fn+0x3c/0x15c
    [  210.279489]  __run_timers.part.0+0x288/0x310
    [  210.283777]  run_timer_softirq+0x48/0x80
    [  210.287716]  __do_softirq+0x128/0x360
    [  210.291392]  __irq_exit_rcu+0x138/0x140
    [  210.295243]  irq_exit_rcu+0x1c/0x30
    [  210.298745]  el1_interrupt+0x38/0x54
    [  210.302334]  el1h_64_irq_handler+0x18/0x24
    [  210.306445]  el1h_64_irq+0x7c/0x80
    [  210.309857]  arch_cpu_idle+0x18/0x2c
    [  210.313445]  default_idle_call+0x4c/0x140
    [  210.317470]  cpuidle_idle_call+0x14c/0x1a0
    [  210.321584]  do_idle+0xb0/0x100
    [  210.324737]  cpu_startup_entry+0x30/0x8c
    [  210.328675]  secondary_start_kernel+0xe4/0x110
    [  210.333138]  __secondary_switched+0x94/0x98

    The assumption when these were relaxed seems to be that device memory
    would be mapped non reordering, and that other constructs
    (spinlocks/etc) would provide the barriers to assure that packet data
    and in memory rings/queues were ordered with respect to device
    register reads/writes. This itself seems a bit sketchy, but the real
    problem with GCC12 is that it is moving the actual reads/writes around
    at will as though they were independent operations when in truth they
    are not, but the compiler can't know that. When looking at the
    assembly dumps for many of these routines its possible to see very
    clean, but not strictly in program order operations occurring as the
    compiler would be free to do if these weren't actually register
    reads/write operations.

    Its possible to suppress the timeout with a liberal bit of dma_mb()'s
    sprinkled around but the device still seems unable to reliably
    send/receive data. A better plan is to use the safer readl/writel
    everywhere.

    Since this partially reverts an older commit, which notes the use of
    the relaxed variants for performance reasons. I would suggest that
    any performance problems
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-988688
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ebac9c6a");
  # https://lore.kernel.org/linux-cve-announce/2025022616-CVE-2022-49194-fc80@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?90671f4d");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49194");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49194");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}