Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992962)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(281183);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/31");

  script_cve_id("CVE-2024-37356");

  script_name(english:"Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992962)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-992962 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

    In dctcp_update_alpha(), we use a module parameter dctcp_shift_g
    as follows:

      alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
      ...
      delivered_ce <<= (10 - dctcp_shift_g);

    It seems syzkaller started fuzzing module parameters and triggered
    shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:

      memcpy((void*)0x20000080,
             /sys/module/tcp_dctcp/parameters/dctcp_shift_g\000, 47);
      res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,
                    /*flags=*/2ul, /*mode=*/0ul);
      memcpy((void*)0x20000000, 100\000, 4);
      syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);

    Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().

    With this patch:

      # echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
      # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g
      10
      # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
      -bash: echo: write error: Invalid argument

    [0]:
    UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12
    shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')
    CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    1.13.0-1ubuntu1.1 04/01/2014
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114
     ubsan_epilogue lib/ubsan.c:231 [inline]
     __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468
     dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143
     tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]
     tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948
     tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711
     tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937
     sk_backlog_rcv include/net/sock.h:1106 [inline]
     __release_sock+0x20f/0x350 net/core/sock.c:2983
     release_sock+0x61/0x1f0 net/core/sock.c:3549
     mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907
     mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976
     __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072
     mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127
     inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437
     __sock_release net/socket.c:659 [inline]
     sock_close+0xc0/0x240 net/socket.c:1421
     __fput+0x41b/0x890 fs/file_table.c:422
     task_work_run+0x23b/0x300 kernel/task_work.c:180
     exit_task_work include/linux/task_work.h:38 [inline]
     do_exit+0x9c8/0x2540 kernel/exit.c:878
     do_group_exit+0x201/0x2b0 kernel/exit.c:1027
     __do_sys_exit_group kernel/exit.c:1038 [inline]
     __se_sys_exit_group kernel/exit.c:1036 [inline]
     __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x67/0x6f
    RIP: 0033:0x7f6c2b5005b6
    Code: Unable to access opcode bytes at 0x7f6c2b50058c.
    RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6
    RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
    RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0
    R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0
    R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-992962
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?999dde21");
  # https://lore.kernel.org/linux-cve-announce/2024062137-CVE-2024-37356-cc7b@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?abbeecfd");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-37356");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-37356");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}