Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990612)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(274162);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/06");

  script_cve_id("CVE-2023-52705");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990612)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990612 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix underflow in second superblock position calculations

    Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second
    superblock, underflows when the argument device size is less than 4096
    bytes.  Therefore, when using this macro, it is necessary to check in
    advance that the device size is not less than a lower limit, or at least
    that underflow does not occur.

    The current nilfs2 implementation lacks this check, causing out-of-bound
    block access when mounting devices smaller than 4096 bytes:

     I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0
     phys_seg 1 prio class 2
     NILFS (loop0): unable to read secondary superblock (blocksize = 1024)

    In addition, when trying to resize the filesystem to a size below 4096
    bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number
    of segments to nilfs_sufile_resize(), corrupting parameters such as the
    number of segments in superblocks.  This causes excessive loop iterations
    in nilfs_sufile_resize() during a subsequent resize ioctl, causing
    semaphore ns_segctor_sem to block for a long time and hang the writer
    thread:

     INFO: task segctord:5067 blocked for more than 143 seconds.
          Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0
     echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message.
     task:segctord        state:D stack:23456 pid:5067  ppid:2
     flags:0x00004000
     Call Trace:
      <TASK>
      context_switch kernel/sched/core.c:5293 [inline]
      __schedule+0x1409/0x43f0 kernel/sched/core.c:6606
      schedule+0xc3/0x190 kernel/sched/core.c:6682
      rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190
      nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357
      nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]
      nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570
      kthread+0x270/0x300 kernel/kthread.c:376
      ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
      </TASK>
     ...
     Call Trace:
      <TASK>
      folio_mark_accessed+0x51c/0xf00 mm/swap.c:515
      __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]
      nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61
      nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121
      nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176
      nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251
      nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]
      nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]
      nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777
      nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422
      nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]
      nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301
      ...

    This fixes these issues by inserting appropriate minimum device size
    checks or anti-underflow checks, depending on where the macro is used.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990612
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13173abc");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-52705");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-52705");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}