Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988956)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273080);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2021-47435");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988956)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-988956 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix mempool NULL pointer race when completing IO

    dm_io_dec_pending() calls end_io_acct() first and will then dec md
    in-flight pending count. But if a task is swapping DM table at same
    time this can result in a crash due to mempool->elements being NULL:

    task1                             task2
    do_resume
     ->do_suspend
      ->dm_wait_for_completion
                                      bio_endio
                                       ->clone_endio
                                        ->dm_io_dec_pending
                                         ->end_io_acct
                                          ->wakeup task1
     ->dm_swap_table
      ->__bind
       ->__bind_mempools
        ->bioset_exit
         ->mempool_exit
                                         ->free_io

    [ 67.330330] Unable to handle kernel NULL pointer dereference at
    virtual address 0000000000000000
    ......
    [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)
    [ 67.330510] pc : mempool_free+0x70/0xa0
    [ 67.330515] lr : mempool_free+0x4c/0xa0
    [ 67.330520] sp : ffffff8008013b20
    [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004
    [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8
    [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800
    [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800
    [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80
    [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c
    [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd
    [ 67.330563] x15: 000000000093b41e x14: 0000000000000010
    [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555
    [ 67.330574] x11: 0000000000000001 x10: 0000000000000001
    [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000
    [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a
    [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001
    [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8
    [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970
    [ 67.330609] Call trace:
    [ 67.330616] mempool_free+0x70/0xa0
    [ 67.330627] bio_put+0xf8/0x110
    [ 67.330638] dec_pending+0x13c/0x230
    [ 67.330644] clone_endio+0x90/0x180
    [ 67.330649] bio_endio+0x198/0x1b8
    [ 67.330655] dec_pending+0x190/0x230
    [ 67.330660] clone_endio+0x90/0x180
    [ 67.330665] bio_endio+0x198/0x1b8
    [ 67.330673] blk_update_request+0x214/0x428
    [ 67.330683] scsi_end_request+0x2c/0x300
    [ 67.330688] scsi_io_completion+0xa0/0x710
    [ 67.330695] scsi_finish_command+0xd8/0x110
    [ 67.330700] scsi_softirq_done+0x114/0x148
    [ 67.330708] blk_done_softirq+0x74/0xd0
    [ 67.330716] __do_softirq+0x18c/0x374
    [ 67.330724] irq_exit+0xb4/0xb8
    [ 67.330732] __handle_domain_irq+0x84/0xc0
    [ 67.330737] gic_handle_irq+0x148/0x1b0
    [ 67.330744] el1_irq+0xe8/0x190
    [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538
    [ 67.330759] cpuidle_enter_state+0x1fc/0x398
    [ 67.330764] cpuidle_enter+0x18/0x20
    [ 67.330772] do_idle+0x1b4/0x290
    [ 67.330778] cpu_startup_entry+0x20/0x28
    [ 67.330786] secondary_start_kernel+0x160/0x170

    Fix this by:
    1) Establishing pointers to 'struct dm_io' members in
    dm_io_dec_pending() so that they may be passed into end_io_acct()
    _after_ free_io() is called.
    2) Moving end_io_acct() after free_io().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-988956
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c280d785");
  # https://lore.kernel.org/linux-cve-announce/2024052238-CVE-2021-47435-65c6@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2267c53c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2021-47435");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-47435");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}