Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990065)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(272669);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2023-52881");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990065)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990065 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent

    This patch is based on a detailed report and ideas from Yepeng Pan
    and Christian Rossow.

    ACK seq validation is currently following RFC 5961 5.2 guidelines:

       The ACK value is considered acceptable only if
       it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
       SND.NXT).  All incoming segments whose ACK value doesn't satisfy the
       above condition MUST be discarded and an ACK sent back.  It needs to
       be noted that RFC 793 on page 72 (fifth check) says: If the ACK is a
       duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK
       acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an
       ACK, drop the segment, and return.  The ignored above implies that
       the processing of the incoming data segment continues, which means
       the ACK value is treated as acceptable.  This mitigation makes the
       ACK check more stringent since any ACK < SND.UNA wouldn't be
       accepted, instead only ACKs that are in the range ((SND.UNA -
       MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.

    This can be refined for new (and possibly spoofed) flows,
    by not accepting ACK for bytes that were never sent.

    This greatly improves TCP security at a little cost.

    I added a Fixes: tag to make sure this patch will reach stable trees,
    even if the 'blamed' patch was adhering to the RFC.

    tp->bytes_acked was added in linux-4.2

    Following packetdrill test (courtesy of Yepeng Pan) shows
    the issue at hand:

    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
    +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
    +0 bind(3, ..., ...) = 0
    +0 listen(3, 1024) = 0

    // ---------------- Handshake ------------------- //

    // when window scale is set to 14 the window size can be extended to
    // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet
    // with ack number in (Server_ISN+1-1073725440. Server_ISN+1)
    // ,though this ack number acknowledges some data never
    // sent by the server.

    +0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
    +0 > S. 0:0(0) ack 1 <...>
    +0 < . 1:1(0) ack 1 win 65535
    +0 accept(3, ..., ...) = 4

    // For the established connection, we send an ACK packet,
    // the ack packet uses ack number 1 - 1073725300 + 2^32,
    // where 2^32 is used to wrap around.
    // Note: we used 1073725300 instead of 1073725440 to avoid possible
    // edge cases.
    // 1 - 1073725300 + 2^32 = 3221241997

    // Oops, old kernels happily accept this packet.
    +0 < . 1:1001(1000) ack 3221241997 win 65535

    // After the kernel fix the following will be replaced by a challenge ACK,
    // and prior malicious frame would be dropped.
    +0 > . 1:1(0) ack 1001

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990065
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7b6e80a4");
  # https://lore.kernel.org/linux-cve-announce/2024052941-CVE-2023-52881-4283@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?799860ca");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-52881");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-52881");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}