Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991113)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278242);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/11");

  script_cve_id("CVE-2023-52933");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991113)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-991113 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: fix handling and sanity checking of xattr_ids count

    A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
    sanity checking of the xattr_ids count in the filesystem.  Both of these
    flaws cause computation overflow due to incorrect typing.

    In the corrupted filesystem the xattr_ids value is 4294967071, which
    stored in a signed variable becomes the negative number -225.

    Flaw 1 (64-bit systems only):

    The signed integer xattr_ids variable causes sign extension.

    This causes variable overflow in the SQUASHFS_XATTR_*(A) macros.  The
    variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
    type of the sizeof operator is unsigned long.

    On a 64-bit system this is 64-bits in size, and causes the negative number
    to be sign extended and widened to 64-bits and then become unsigned.  This
    produces the very large number 18446744073709548016 or 2^64 - 3600.  This
    number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and
    divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0
    (stored in len).

    Flaw 2 (32-bit systems only):

    On a 32-bit system the integer variable is not widened by the unsigned
    long type of the sizeof operator (32-bits), and the signedness of the
    variable has no effect due it always being treated as unsigned.

    The above corrupted xattr_ids value of 4294967071, when multiplied
    overflows and produces the number 4294963696 or 2^32 - 3400.  This number
    when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by
    SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.

    The effect of the 0 length computation:

    In conjunction with the corrupted xattr_ids field, the filesystem also has
    a corrupted xattr_table_start value, where it matches the end of
    filesystem value of 850.

    This causes the following sanity check code to fail because the
    incorrectly computed len of 0 matches the incorrect size of the table
    reported by the superblock (0 bytes).

        len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
        indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);

        /*
         * The computed size of the index table (len bytes) should exactly
         * match the table start and end points
        */
        start = table_start + sizeof(*id_table);
        end = msblk->bytes_used;

        if (len != (end - start))
                return ERR_PTR(-EINVAL);

    Changing the xattr_ids variable to be usigned int fixes the flaw on a
    64-bit system.  This relies on the fact the computation is widened by the
    unsigned long type of the sizeof operator.

    Casting the variable to u64 in the above macro fixes this flaw on a 32-bit
    system.

    It also means 64-bit systems do not implicitly rely on the type of the
    sizeof operator to widen the computation.

    [1] https://lore.kernel.org/lkml/[email protected]/

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-991113
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4f527160");
  # https://lore.kernel.org/linux-cve-announce/2025032720-CVE-2023-52933-f292@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?25e279b3");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-52933");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-52933");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/03/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.45', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.45', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.45', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}