Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990806)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275139);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/12");

  script_cve_id("CVE-2022-49775");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990806)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-990806 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: cdg: allow tcp_cdg_release() to be called multiple times

    Apparently, mptcp is able to call tcp_disconnect() on an already
    disconnected flow. This is generally fine, unless current congestion
    control is CDG, because it might trigger a double-free [1]

    Instead of fixing MPTCP, and future bugs, we can make tcp_disconnect()
    more resilient.

    [1]
    BUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline]
    BUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567

    CPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
    Workqueue: events mptcp_worker
    Call Trace:
    <TASK>
    __dump_stack lib/dump_stack.c:88 [inline]
    dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
    print_address_description mm/kasan/report.c:317 [inline]
    print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
    kasan_report_invalid_free+0x81/0x190 mm/kasan/report.c:462
    ____kasan_slab_free+0x18b/0x1c0 mm/kasan/common.c:356
    kasan_slab_free include/linux/kasan.h:200 [inline]
    slab_free_hook mm/slub.c:1759 [inline]
    slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785
    slab_free mm/slub.c:3539 [inline]
    kfree+0xe2/0x580 mm/slub.c:4567
    tcp_disconnect+0x980/0x1e20 net/ipv4/tcp.c:3145
    __mptcp_close_ssk+0x5ca/0x7e0 net/mptcp/protocol.c:2327
    mptcp_do_fastclose net/mptcp/protocol.c:2592 [inline]
    mptcp_worker+0x78c/0xff0 net/mptcp/protocol.c:2627
    process_one_work+0x991/0x1610 kernel/workqueue.c:2289
    worker_thread+0x665/0x1080 kernel/workqueue.c:2436
    kthread+0x2e4/0x3a0 kernel/kthread.c:376
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
    </TASK>

    Allocated by task 3671:
    kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
    kasan_set_track mm/kasan/common.c:45 [inline]
    set_alloc_info mm/kasan/common.c:437 [inline]
    ____kasan_kmalloc mm/kasan/common.c:516 [inline]
    ____kasan_kmalloc mm/kasan/common.c:475 [inline]
    __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525
    kmalloc_array include/linux/slab.h:640 [inline]
    kcalloc include/linux/slab.h:671 [inline]
    tcp_cdg_init+0x10d/0x170 net/ipv4/tcp_cdg.c:380
    tcp_init_congestion_control+0xab/0x550 net/ipv4/tcp_cong.c:193
    tcp_reinit_congestion_control net/ipv4/tcp_cong.c:217 [inline]
    tcp_set_congestion_control+0x96c/0xaa0 net/ipv4/tcp_cong.c:391
    do_tcp_setsockopt+0x505/0x2320 net/ipv4/tcp.c:3513
    tcp_setsockopt+0xd4/0x100 net/ipv4/tcp.c:3801
    mptcp_setsockopt+0x35f/0x2570 net/mptcp/sockopt.c:844
    __sys_setsockopt+0x2d6/0x690 net/socket.c:2252
    __do_sys_setsockopt net/socket.c:2263 [inline]
    __se_sys_setsockopt net/socket.c:2260 [inline]
    __x64_sys_setsockopt+0xba/0x150 net/socket.c:2260
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

    Freed by task 16:
    kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
    kasan_set_track+0x21/0x30 mm/kasan/common.c:45
    kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
    ____kasan_slab_free mm/kasan/common.c:367 [inline]
    ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329
    kasan_slab_free include/linux/kasan.h:200 [inline]
    slab_free_hook mm/slub.c:1759 [inline]
    slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785
    slab_free mm/slub.c:3539 [inline]
    kfree+0xe2/0x580 mm/slub.c:4567
    tcp_cleanup_congestion_control+0x70/0x120 net/ipv4/tcp_cong.c:226
    tcp_v4_destroy_sock+0xdd/0x750 net/ipv4/tcp_ipv4.c:2254
    tcp_v6_destroy_sock+0x11/0x20 net/ipv6/tcp_ipv6.c:1969
    inet_csk_destroy_sock+0x196/0x440 net/ipv4/inet_connection_sock.c:1157
    tcp_done+0x23b/0x340 net/ipv4/tcp.c:4649
    tcp_rcv_state_process+0x40e7/0x4990 net/ipv4/tcp_input.c:6624
    tcp_v6_do_rcv+0x3fc/0x13c0 net/ipv6/tcp_ipv6.c:1525
    tcp_v6_rcv+0x2e8e/0x3830 net/ipv6/tcp_ipv6.c:1759
    ip6_protocol_deliver_rcu+0x2db/0x1950 net/ipv6/ip6_input.c:439
    ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484
    NF_HOOK include/linux/netfilter.h:302 [inline]
    NF_HOOK include/linux/netfilter.h:296 [inline]
    ip6_input+0x9c/0xd
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-990806
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8d6d3348");
  # https://lore.kernel.org/linux-cve-announce/2025050117-CVE-2022-49775-6a5c@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4a57a767");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-49775");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-49775");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.4.2', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}