Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990758)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275048);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/12");

  script_cve_id("CVE-2022-49789");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990758)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990758 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: zfcp: Fix double free of FSF request when qdio send fails

    We used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache
    the FSF request ID when sending a new FSF request. This is used in case the
    sending fails and we need to remove the request from our internal hash
    table again (so we don't keep an invalid reference and use it when we free
    the request again).

    In 'zfcp_fsf_req_send()' we used to cache the ID as 'int' (signed and 32
    bit wide), but the rest of the zfcp code (and the firmware specification)
    handles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x
    ELF ABI]).  For one this has the obvious problem that when the ID grows
    past 32 bit (this can happen reasonably fast) it is truncated to 32 bit
    when storing it in the cache variable and so doesn't match the original ID
    anymore.  The second less obvious problem is that even when the original ID
    has not yet grown past 32 bit, as soon as the 32nd bit is set in the
    original ID (0x80000000 = 2'147'483'648) we will have a mismatch when we
    cast it back to 'unsigned long'. As the cached variable is of a signed
    type, the compiler will choose a sign-extending instruction to load the 32
    bit variable into a 64 bit register (e.g.: 'lgf %r11,188(%r15)'). So once
    we pass the cached variable into 'zfcp_reqlist_find_rm()' to remove the
    request again all the leading zeros will be flipped to ones to extend the
    sign and won't match the original ID anymore (this has been observed in
    practice).

    If we can't successfully remove the request from the hash table again after
    'zfcp_qdio_send()' fails (this happens regularly when zfcp cannot notify
    the adapter about new work because the adapter is already gone during
    e.g. a ChpID toggle) we will end up with a double free.  We unconditionally
    free the request in the calling function when 'zfcp_fsf_req_send()' fails,
    but because the request is still in the hash table we end up with a stale
    memory reference, and once the zfcp adapter is either reset during recovery
    or shutdown we end up freeing the same memory twice.

    The resulting stack traces vary depending on the kernel and have no direct
    correlation to the place where the bug occurs. Here are three examples that
    have been seen in practice:

      list_del corruption. next->prev should be 00000001b9d13800, but was 00000000dead4ead.
    (next=00000001bd131a00)
      ------------[ cut here ]------------
      kernel BUG at lib/list_debug.c:62!
      monitor event: 0040 ilc:2 [#1] PREEMPT SMP
      Modules linked in: ...
      CPU: 9 PID: 1617 Comm: zfcperp0.0.1740 Kdump: loaded
      Hardware name: ...
      Krnl PSW : 0704d00180000000 00000003cbeea1f8 (__list_del_entry_valid+0x98/0x140)
                 R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
      Krnl GPRS: 00000000916d12f1 0000000080000000 000000000000006d 00000003cb665cd6
                 0000000000000001 0000000000000000 0000000000000000 00000000d28d21e8
                 00000000d3844000 00000380099efd28 00000001bd131a00 00000001b9d13800
                 00000000d3290100 0000000000000000 00000003cbeea1f4 00000380099efc70
      Krnl Code: 00000003cbeea1e8: c020004f68a7        larl    %r2,00000003cc8d7336
                 00000003cbeea1ee: c0e50027fd65        brasl   %r14,00000003cc3e9cb8
                #00000003cbeea1f4: af000000            mc      0,0
                >00000003cbeea1f8: c02000920440        larl    %r2,00000003cd12aa78
                 00000003cbeea1fe: c0e500289c25        brasl   %r14,00000003cc3fda48
                 00000003cbeea204: b9040043            lgr     %r4,%r3
                 00000003cbeea208: b9040051            lgr     %r5,%r1
                 00000003cbeea20c: b9040032            lgr     %r3,%r2
      Call Trace:
       [<00000003cbeea1f8>] __list_del_entry_valid+0x98/0x140
      ([<00000003cbeea1f4>] __list_del_entry_valid+0x94/0x140)
       [<000003ff7ff502fe>] zfcp_fsf_req_dismiss_all+0xde/0x150 [zfcp]
       [<000003ff7ff49cd0>] zfcp_erp_strategy_do_action+0x160/0x280 [zfcp]
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990758
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?064324d5");
  # https://lore.kernel.org/linux-cve-announce/2025050122-CVE-2022-49789-39ec@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d21403d4");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49789");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49789");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}