Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990366)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(272521);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2024-26957");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990366)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990366 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    s390/zcrypt: fix reference counting on zcrypt card objects

    Tests with hot-plugging crytpo cards on KVM guests with debug
    kernel build revealed an use after free for the load field of
    the struct zcrypt_card. The reason was an incorrect reference
    handling of the zcrypt card object which could lead to a free
    of the zcrypt card object while it was still in use.

    This is an example of the slab message:

        kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b
        kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43
        kernel:  kmalloc_trace+0x3f2/0x470
        kernel:  zcrypt_card_alloc+0x36/0x70 [zcrypt]
        kernel:  zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4]
        kernel:  ap_device_probe+0x15c/0x290
        kernel:  really_probe+0xd2/0x468
        kernel:  driver_probe_device+0x40/0xf0
        kernel:  __device_attach_driver+0xc0/0x140
        kernel:  bus_for_each_drv+0x8c/0xd0
        kernel:  __device_attach+0x114/0x198
        kernel:  bus_probe_device+0xb4/0xc8
        kernel:  device_add+0x4d2/0x6e0
        kernel:  ap_scan_adapter+0x3d0/0x7c0
        kernel:  ap_scan_bus+0x5a/0x3b0
        kernel:  ap_scan_bus_wq_callback+0x40/0x60
        kernel:  process_one_work+0x26e/0x620
        kernel:  worker_thread+0x21c/0x440
        kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43
        kernel:  kfree+0x37e/0x418
        kernel:  zcrypt_card_put+0x54/0x80 [zcrypt]
        kernel:  ap_device_remove+0x4c/0xe0
        kernel:  device_release_driver_internal+0x1c4/0x270
        kernel:  bus_remove_device+0x100/0x188
        kernel:  device_del+0x164/0x3c0
        kernel:  device_unregister+0x30/0x90
        kernel:  ap_scan_adapter+0xc8/0x7c0
        kernel:  ap_scan_bus+0x5a/0x3b0
        kernel:  ap_scan_bus_wq_callback+0x40/0x60
        kernel:  process_one_work+0x26e/0x620
        kernel:  worker_thread+0x21c/0x440
        kernel:  kthread+0x150/0x168
        kernel:  __ret_from_fork+0x3c/0x58
        kernel:  ret_from_fork+0xa/0x30
        kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88
    flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff)
        kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88
        kernel: Redzone  00000000885a74b0: bb bb bb bb bb bb bb bb                          ........
        kernel: Object   00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
        kernel: Object   00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
        kernel: Object   00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
        kernel: Object   00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
        kernel: Object   00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
        kernel: Object   00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5  kkkkkkkkkkhKkkk.
        kernel: Redzone  00000000885a7518: bb bb bb bb bb bb bb bb                          ........
        kernel: Padding  00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ
        kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2
        kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux)
        kernel: Call Trace:
        kernel:  [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120
        kernel:  [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140
        kernel:  [<00000000c99d53cc>] check_object+0x334/0x3f8
        kernel:  [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8
        kernel:  [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0
        kernel:  [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8
        kernel:  [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8
        kernel:  [<00000000c99dc8dc>] __kmalloc+0x434/0x590
        kernel:  [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0
        kernel:  [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0
        kernel:
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990366
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f4f7588f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-26957");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-26957");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}