Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989888)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(273247);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2023-52784");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989888)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-989888 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave()

    Commit 9eed321cde22 (net: lapbether: only support ethernet devices)
    has been able to keep syzbot away from net/lapb, until today.

    In the following splat [1], the issue is that a lapbether device has
    been created on a bonding device without members. Then adding a non
    ARPHRD_ETHER member forced the bonding master to change its type.

    The fix is to make sure we call dev_close() in bond_setup_by_slave()
    so that the potential linked lapbether devices (or any other devices
    having assumptions on the physical device) are removed.

    A similar bug has been addressed in commit 40baec225765
    (bonding: fix panic on non-ARPHRD_ETHER enslave failure)

    [1]
    skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea
    tail:0x16 end:0x140 dev:bond0
    kernel BUG at net/core/skbuff.c:192 !
    Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
    pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : skb_panic net/core/skbuff.c:188 [inline]
    pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
    lr : skb_panic net/core/skbuff.c:188 [inline]
    lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
    sp : ffff800096a06aa0
    x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000
    x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea
    x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140
    x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100
    x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001
    x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000
    x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00
    x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001
    x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c
    x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
    Call trace:
    skb_panic net/core/skbuff.c:188 [inline]
    skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
    skb_push+0xf0/0x108 net/core/skbuff.c:2446
    ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384
    dev_hard_header include/linux/netdevice.h:3136 [inline]
    lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257
    lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447
    lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149
    lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251
    __lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326
    lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492
    notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
    raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
    call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
    call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
    call_netdevice_notifiers net/core/dev.c:2022 [inline]
    __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
    dev_close_many+0x1e0/0x470 net/core/dev.c:1559
    dev_close+0x174/0x250 net/core/dev.c:1585
    lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466
    notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
    raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
    call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
    call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
    call_netdevice_notifiers net/core/dev.c:2022 [inline]
    __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
    dev_close_many+0x1e0/0x470 net/core/dev.c:1559
    dev_close+0x174/0x250 net/core/dev.c:1585
    bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332
    bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539
    dev_ifsioc+0x754/0x9ac
    dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786
    sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217
    sock_ioctl+0x4e8/0x834 net/socket.c:1322
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-989888
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?22fb4400");
  # https://lore.kernel.org/linux-cve-announce/2024052154-CVE-2023-52784-80ad@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a4754ce6");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-52784");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-52784");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}