Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989046)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273005);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2022-48855");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989046)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-989046 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix kernel-infoleak for SCTP sockets

    syzbot reported a kernel infoleak [1] of 4 bytes.

    After analysis, it turned out r->idiag_expires is not initialized
    if inet_sctp_diag_fill() calls inet_diag_msg_common_fill()

    Make sure to clear idiag_timer/idiag_retrans/idiag_expires
    and let inet_diag_msg_sctpasoc_fill() fill them again if needed.

    [1]

    BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
    BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline]
    BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668
     instrument_copy_to_user include/linux/instrumented.h:121 [inline]
     copyout lib/iov_iter.c:154 [inline]
     _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668
     copy_to_iter include/linux/uio.h:162 [inline]
     simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519
     __skb_datagram_iter+0x2d5/0x11b0 net/core/datagram.c:425
     skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533
     skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline]
     netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977
     sock_recvmsg_nosec net/socket.c:948 [inline]
     sock_recvmsg net/socket.c:966 [inline]
     __sys_recvfrom+0x795/0xa10 net/socket.c:2097
     __do_sys_recvfrom net/socket.c:2115 [inline]
     __se_sys_recvfrom net/socket.c:2111 [inline]
     __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111
     do_syscall_x64 arch/x86/entry/common.c:51 [inline]
     do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
     entry_SYSCALL_64_after_hwframe+0x44/0xae

    Uninit was created at:
     slab_post_alloc_hook mm/slab.h:737 [inline]
     slab_alloc_node mm/slub.c:3247 [inline]
     __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975
     kmalloc_reserve net/core/skbuff.c:354 [inline]
     __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
     alloc_skb include/linux/skbuff.h:1158 [inline]
     netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248
     __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373
     netlink_dump_start include/linux/netlink.h:254 [inline]
     inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341
     sock_diag_rcv_msg+0x24a/0x620
     netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494
     sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277
     netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
     netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343
     netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919
     sock_sendmsg_nosec net/socket.c:705 [inline]
     sock_sendmsg net/socket.c:725 [inline]
     sock_write_iter+0x594/0x690 net/socket.c:1061
     do_iter_readv_writev+0xa7f/0xc70
     do_iter_write+0x52c/0x1500 fs/read_write.c:851
     vfs_writev fs/read_write.c:924 [inline]
     do_writev+0x645/0xe00 fs/read_write.c:967
     __do_sys_writev fs/read_write.c:1040 [inline]
     __se_sys_writev fs/read_write.c:1037 [inline]
     __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037
     do_syscall_x64 arch/x86/entry/common.c:51 [inline]
     do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
     entry_SYSCALL_64_after_hwframe+0x44/0xae

    Bytes 68-71 of 2508 are uninitialized
    Memory access of size 2508 starts at ffff888114f9b000
    Data copied to user address 00007f7fe09ff2e0

    CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-989046
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4e1fbd11");
  # https://lore.kernel.org/linux-cve-announce/2024071626-CVE-2022-48855-cce9@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3a45ad1c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-48855");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-48855");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}