Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989810)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273519);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2024-56587");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989810)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-989810 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    leds: class: Protect brightness_show() with led_cdev->led_access mutex

    There is NULL pointer issue observed if from Process A where hid device
    being added which results in adding a led_cdev addition and later a
    another call to access of led_cdev attribute from Process B can result
    in NULL pointer issue.

    Use mutex led_cdev->led_access to protect access to led->cdev and its
    attribute inside brightness_show() and max_brightness_show() and also
    update the comment for mutex that it should be used to protect the led
    class device fields.

            Process A                               Process B

     kthread+0x114
     worker_thread+0x244
     process_scheduled_works+0x248
     uhid_device_add_worker+0x24
     hid_add_device+0x120
     device_add+0x268
     bus_probe_device+0x94
     device_initial_probe+0x14
     __device_attach+0xfc
     bus_for_each_drv+0x10c
     __device_attach_driver+0x14c
     driver_probe_device+0x3c
     __driver_probe_device+0xa0
     really_probe+0x190
     hid_device_probe+0x130
     ps_probe+0x990
     ps_led_register+0x94
     devm_led_classdev_register_ext+0x58
     led_classdev_register_ext+0x1f8
     device_create_with_groups+0x48
     device_create_groups_vargs+0xc8
     device_add+0x244
     kobject_uevent+0x14
     kobject_uevent_env[jt]+0x224
     mutex_unlock[jt]+0xc4
     __mutex_unlock_slowpath+0xd4
     wake_up_q+0x70
     try_to_wake_up[jt]+0x48c
     preempt_schedule_common+0x28
     __schedule+0x628
     __switch_to+0x174
                                                    el0t_64_sync+0x1a8/0x1ac
                                                    el0t_64_sync_handler+0x68/0xbc
                                                    el0_svc+0x38/0x68
                                                    do_el0_svc+0x1c/0x28
                                                    el0_svc_common+0x80/0xe0
                                                    invoke_syscall+0x58/0x114
                                                    __arm64_sys_read+0x1c/0x2c
                                                    ksys_read+0x78/0xe8
                                                    vfs_read+0x1e0/0x2c8
                                                    kernfs_fop_read_iter+0x68/0x1b4
                                                    seq_read_iter+0x158/0x4ec
                                                    kernfs_seq_show+0x44/0x54
                                                    sysfs_kf_seq_show+0xb4/0x130
                                                    dev_attr_show+0x38/0x74
                                                    brightness_show+0x20/0x4c
                                                    dualshock4_led_get_brightness+0xc/0x74

    [ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000060
    [ 3313.874301][ T4013] Mem abort info:
    [ 3313.874303][ T4013]   ESR = 0x0000000096000006
    [ 3313.874305][ T4013]   EC = 0x25: DABT (current EL), IL = 32 bits
    [ 3313.874307][ T4013]   SET = 0, FnV = 0
    [ 3313.874309][ T4013]   EA = 0, S1PTW = 0
    [ 3313.874311][ T4013]   FSC = 0x06: level 2 translation fault
    [ 3313.874313][ T4013] Data abort info:
    [ 3313.874314][ T4013]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
    [ 3313.874316][ T4013]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    [ 3313.874318][ T4013]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    [ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000
    ..

    [ 3313.874332][ T4013] Dumping ftrace buffer:
    [ 3313.874334][ T4013]    (ftrace buffer empty)
    ..
    ..
    [ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader
    [ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74
    [ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60
    [ 3313.874656][ T4013] sp : ffffffc0b910bbd0
    ..
    ..
    [ 3313.874685][ T4013] Call trace:
    [ 3313.874687][ T4013]  dualshock4_led_get_brightness+0xc/0x74
    [ 3313.874690][ T4013]  brightness_show+0x20/0x4c
    [ 3313.874692][ T4013]  dev_attr_show+0x38/0x74
    [ 3313.874696][ T4013]  sysfs_kf_seq_show+0xb4/0x130
    [ 3313.874700][ T4013]  kernfs_seq_show+0x44/0x54
    [ 3313.874703][ T4013]  seq_read_iter+0x158/0x4ec
    [ 3313.874705][ T4013]  kernfs_fop_read_iter+0x68/0x1b4
    [ 3313.874708][ T4013]  vfs_read+0x1e0/0x2c8
    [ 3313.874711][ T4013]  ksys_read+0x78/0xe8
    [ 3313.874714][ T4013]  __arm64_sys_read+0x1c/0x2c
    [ 3313.874718][ T4013]  invoke_syscall+0x58/0x114
    [ 3313.874721][ T4013]  el0_svc_common+0x80/0xe0
    [ 3313.874724][ T4013]  do_el0_svc+0x1c/0x28
    [ 3313.874727][ T4013]  el0_svc+0x38/0x68
    [ 3313.874730][ T4013]  el0t_64_sync_handler+0x68/0xbc
    [ 3313.874732][ T4013]  el0t_64_sync+0x1a8/0x1ac

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-989810
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f407b583");
  # https://lore.kernel.org/linux-cve-announce/2024122758-CVE-2024-56587-1786@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c0c8ef08");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-56587");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-56587");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}