Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993145)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(281257);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/31");

  script_cve_id("CVE-2022-50280");

  script_name(english:"Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993145)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-993145 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    pnode: terminate at peers of source

    The propagate_mnt() function handles mount propagation when creating
    mounts and propagates the source mount tree @source_mnt to all
    applicable nodes of the destination propagation mount tree headed by
    @dest_mnt.

    Unfortunately it contains a bug where it fails to terminate at peers of
    @source_mnt when looking up copies of the source mount that become
    masters for copies of the source mount tree mounted on top of slaves in
    the destination propagation tree causing a NULL dereference.

    Once the mechanics of the bug are understood it's easy to trigger.
    Because of unprivileged user namespaces it is available to unprivileged
    users.

    While fixing this bug we've gotten confused multiple times due to
    unclear terminology or missing concepts. So let's start this with some
    clarifications:

    * The terms master or peer denote a shared mount. A shared mount
      belongs to a peer group.

    * A peer group is a set of shared mounts that propagate to each other.
      They are identified by a peer group id. The peer group id is available
      in @shared_mnt->mnt_group_id.
      Shared mounts within the same peer group have the same peer group id.
      The peers in a peer group can be reached via @shared_mnt->mnt_share.

    * The terms slave mount or dependent mount denote a mount that
      receives propagation from a peer in a peer group. IOW, shared mounts
      may have slave mounts and slave mounts have shared mounts as their
      master. Slave mounts of a given peer in a peer group are listed on
      that peers slave list available at @shared_mnt->mnt_slave_list.

    * The term master mount denotes a mount in a peer group. IOW, it
      denotes a shared mount or a peer mount in a peer group. The term
      master mount - or master for short - is mostly used when talking
      in the context of slave mounts that receive propagation from a master
      mount. A master mount of a slave identifies the closest peer group a
      slave mount receives propagation from. The master mount of a slave can
      be identified via @slave_mount->mnt_master. Different slaves may point
      to different masters in the same peer group.

    * Multiple peers in a peer group can have non-empty ->mnt_slave_lists.
      Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to
      ensure all slave mounts of a peer group are visited the
      ->mnt_slave_lists of all peers in a peer group have to be walked.

    * Slave mounts point to a peer in the closest peer group they receive
      propagation from via @slave_mnt->mnt_master (see above). Together with
      these peers they form a propagation group (see below). The closest
      peer group can thus be identified through the peer group id
      @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave
      mount receives propagation from.

    * A shared-slave mount is a slave mount to a peer group pg1 while also
      a peer in another peer group pg2. IOW, a peer group may receive
      propagation from another peer group.

      If a peer group pg1 is a slave to another peer group pg2 then all
      peers in peer group pg1 point to the same peer in peer group pg2 via
      ->mnt_master. IOW, all peers in peer group pg1 appear on the same
      ->mnt_slave_list. IOW, they cannot be slaves to different peer groups.

    * A pure slave mount is a slave mount that is a slave to a peer group
      but is not a peer in another peer group.

    * A propagation group denotes the set of mounts consisting of a single
      peer group pg1 and all slave mounts and shared-slave mounts that point
      to a peer in that peer group via ->mnt_master. IOW, all slave mounts
      such that @slave_mnt->mnt_master->mnt_group_id is equal to
      @shared_mnt->mnt_group_id.

      The concept of a propagation group makes it easier to talk about a
      single propagation level in a propagation tree.

      For example, in propagate_mnt() the immediate peers of @dest_mnt and
      all slaves of @dest_mnt's peer group form a propagation group pr
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-993145
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?96a3d62e");
  # https://lore.kernel.org/linux-cve-announce/2025091506-CVE-2022-50280-762f@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d059cbc3");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50280");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50280");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}