Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988930)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273155);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2022-49349");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988930)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-988930 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in ext4_rename_dir_prepare

    We got issue as follows:
    EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
    ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478
    ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000
    ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae
    ==================================================================
    BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220
    Read of size 4 at addr ffff88810beee6ae by task rep/1895

    CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241
    Call Trace:
     dump_stack+0xbe/0xf9
     print_address_description.constprop.0+0x1e/0x220
     kasan_report.cold+0x37/0x7f
     ext4_rename_dir_prepare+0x152/0x220
     ext4_rename+0xf44/0x1ad0
     ext4_rename2+0x11c/0x170
     vfs_rename+0xa84/0x1440
     do_renameat2+0x683/0x8f0
     __x64_sys_renameat+0x53/0x60
     do_syscall_64+0x33/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7f45a6fc41c9
    RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9
    RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005
    RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080
    R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0
    R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000

    The buggy address belongs to the page:
    page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee
    flags: 0x200000000000000()
    raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000
    raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
     ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
     ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    >ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                      ^
     ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
     ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    ==================================================================
    Disabling lock debugging due to kernel taint
    ext4_rename_dir_prepare: [2] parent_de->inode=3537895424
    ext4_rename_dir_prepare: [3] dir=0xffff888124170140
    ext4_rename_dir_prepare: [4] ino=2
    ext4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872

    Reason is first directory entry which 'rec_len' is 34478, then will get illegal
    parent entry. Now, we do not check directory entry after read directory block
    in 'ext4_get_first_dir_block'.
    To solve this issue, check directory entry in 'ext4_get_first_dir_block'.

    [ Trigger an ext4_error() instead of just warning if the directory is
      missing a '.' or '..' entry.   Also make sure we return an error code
      if the file system is corrupted.  -TYT ]

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-988930
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fab11f67");
  # https://lore.kernel.org/linux-cve-announce/2025022642-CVE-2022-49349-a7f6@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6ddfd754");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49349");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49349");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/06/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}