Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990633)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(274121);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/06");

  script_cve_id("CVE-2022-49298");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990633)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990633 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    staging: rtl8712: fix uninit-value in r871xu_drv_init()

    When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
    'mac[6]' will not be initialized.

    BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
     r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
     usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
     really_probe+0x653/0x14b0 drivers/base/dd.c:596
     __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
     driver_probe_device drivers/base/dd.c:782 [inline]
     __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
     bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
     __device_attach+0x593/0x8e0 drivers/base/dd.c:970
     device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
     bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
     device_add+0x1fff/0x26e0 drivers/base/core.c:3405
     usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
     usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
     usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
     really_probe+0x653/0x14b0 drivers/base/dd.c:596
     __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
     driver_probe_device drivers/base/dd.c:782 [inline]
     __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
     bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
     __device_attach+0x593/0x8e0 drivers/base/dd.c:970
     device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
     bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
     device_add+0x1fff/0x26e0 drivers/base/core.c:3405
     usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
     hub_port_connect drivers/usb/core/hub.c:5358 [inline]
     hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
     port_event drivers/usb/core/hub.c:5660 [inline]
     hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
     process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
     worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
     kthread+0x3c7/0x500 kernel/kthread.c:377
     ret_from_fork+0x1f/0x30

    Local variable mac created at:
     r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
     usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396

    KMSAN: uninit-value in r871xu_drv_init
    https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990633
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56e039fb");
  # https://lore.kernel.org/linux-cve-announce/2025022625-CVE-2022-49298-bc33@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e4fc67c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49298");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49298");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.003', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}