Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988861)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273494);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2023-52885");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988861)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-988861 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

    After the listener svc_sock is freed, and before invoking svc_tcp_accept()
    for the established child sock, there is a window that the newsock
    retaining a freed listener svc_sock in sk_user_data which cloning from
    parent. In the race window, if data is received on the newsock, we will
    observe use-after-free report in svc_tcp_listen_data_ready().

    Reproduce by two tasks:

    1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
    2. while :; do echo  | ncat -4 127.0.0.1 2049 ; done

    KASAN report:

      ==================================================================
      BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
      Read of size 8 at addr ffff888139d96228 by task nc/102553
      CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18
      Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00
    11/12/2020
      Call Trace:
       <IRQ>
       dump_stack_lvl+0x33/0x50
       print_address_description.constprop.0+0x27/0x310
       print_report+0x3e/0x70
       kasan_report+0xae/0xe0
       svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
       tcp_data_queue+0x9f4/0x20e0
       tcp_rcv_established+0x666/0x1f60
       tcp_v4_do_rcv+0x51c/0x850
       tcp_v4_rcv+0x23fc/0x2e80
       ip_protocol_deliver_rcu+0x62/0x300
       ip_local_deliver_finish+0x267/0x350
       ip_local_deliver+0x18b/0x2d0
       ip_rcv+0x2fb/0x370
       __netif_receive_skb_one_core+0x166/0x1b0
       process_backlog+0x24c/0x5e0
       __napi_poll+0xa2/0x500
       net_rx_action+0x854/0xc90
       __do_softirq+0x1bb/0x5de
       do_softirq+0xcb/0x100
       </IRQ>
       <TASK>
       ...
       </TASK>

      Allocated by task 102371:
       kasan_save_stack+0x1e/0x40
       kasan_set_track+0x21/0x30
       __kasan_kmalloc+0x7b/0x90
       svc_setup_socket+0x52/0x4f0 [sunrpc]
       svc_addsock+0x20d/0x400 [sunrpc]
       __write_ports_addfd+0x209/0x390 [nfsd]
       write_ports+0x239/0x2c0 [nfsd]
       nfsctl_transaction_write+0xac/0x110 [nfsd]
       vfs_write+0x1c3/0xae0
       ksys_write+0xed/0x1c0
       do_syscall_64+0x38/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

      Freed by task 102551:
       kasan_save_stack+0x1e/0x40
       kasan_set_track+0x21/0x30
       kasan_save_free_info+0x2a/0x50
       __kasan_slab_free+0x106/0x190
       __kmem_cache_free+0x133/0x270
       svc_xprt_free+0x1e2/0x350 [sunrpc]
       svc_xprt_destroy_all+0x25a/0x440 [sunrpc]
       nfsd_put+0x125/0x240 [nfsd]
       nfsd_svc+0x2cb/0x3c0 [nfsd]
       write_threads+0x1ac/0x2a0 [nfsd]
       nfsctl_transaction_write+0xac/0x110 [nfsd]
       vfs_write+0x1c3/0xae0
       ksys_write+0xed/0x1c0
       do_syscall_64+0x38/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

    Fix the UAF by simply doing nothing in svc_tcp_listen_data_ready()
    if state != TCP_LISTEN, that will avoid dereferencing svsk for all
    child socket.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-988861
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a04bfe6f");
  # https://lore.kernel.org/linux-cve-announce/2024071432-CVE-2023-52885-e934@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?22a49869");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-52885");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-52885");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}