Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993262)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(281059);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/31");

  script_cve_id("CVE-2025-22075");

  script_name(english:"Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993262)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-993262 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported

    Commit 30aad41721e0 (net/core: Add support for getting VF GUIDs)
    added support for getting VF port and node GUIDs in netlink ifinfo
    messages, but their size was not taken into consideration in the
    function that allocates the netlink message, causing the following
    warning when a netlink message is filled with many VF port and node
    GUIDs:
     # echo 64 > /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs
     # ip link show dev ib0
     RTNETLINK answers: Message too long
     Cannot send link get request: Message too long

    Kernel warning:

     ------------[ cut here ]------------
     WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0
     Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter
    overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi
    ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core
     CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1
     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org
    04/01/2014
     RIP: 0010:rtnl_getlink+0x586/0x5a0
     Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07
    80 4f cb 82 e9 36 fc ff ff <0f> 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00
     RSP: 0018:ffff888113557348 EFLAGS: 00010246
     RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000
     RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8
     RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000
     R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00
     R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff
     FS:  00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
     PKRU: 55555554
     Call Trace:
      <TASK>
      ? __warn+0xa5/0x230
      ? rtnl_getlink+0x586/0x5a0
      ? report_bug+0x22d/0x240
      ? handle_bug+0x53/0xa0
      ? exc_invalid_op+0x14/0x50
      ? asm_exc_invalid_op+0x16/0x20
      ? skb_trim+0x6a/0x80
      ? rtnl_getlink+0x586/0x5a0
      ? __pfx_rtnl_getlink+0x10/0x10
      ? rtnetlink_rcv_msg+0x1e5/0x860
      ? __pfx___mutex_lock+0x10/0x10
      ? rcu_is_watching+0x34/0x60
      ? __pfx_lock_acquire+0x10/0x10
      ? stack_trace_save+0x90/0xd0
      ? filter_irq_stacks+0x1d/0x70
      ? kasan_save_stack+0x30/0x40
      ? kasan_save_stack+0x20/0x40
      ? kasan_save_track+0x10/0x30
      rtnetlink_rcv_msg+0x21c/0x860
      ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
      ? __pfx_rtnetlink_rcv_msg+0x10/0x10
      ? arch_stack_walk+0x9e/0xf0
      ? rcu_is_watching+0x34/0x60
      ? lock_acquire+0xd5/0x410
      ? rcu_is_watching+0x34/0x60
      netlink_rcv_skb+0xe0/0x210
      ? __pfx_rtnetlink_rcv_msg+0x10/0x10
      ? __pfx_netlink_rcv_skb+0x10/0x10
      ? rcu_is_watching+0x34/0x60
      ? __pfx___netlink_lookup+0x10/0x10
      ? lock_release+0x62/0x200
      ? netlink_deliver_tap+0xfd/0x290
      ? rcu_is_watching+0x34/0x60
      ? lock_release+0x62/0x200
      ? netlink_deliver_tap+0x95/0x290
      netlink_unicast+0x31f/0x480
      ? __pfx_netlink_unicast+0x10/0x10
      ? rcu_is_watching+0x34/0x60
      ? lock_acquire+0xd5/0x410
      netlink_sendmsg+0x369/0x660
      ? lock_release+0x62/0x200
      ? __pfx_netlink_sendmsg+0x10/0x10
      ? import_ubuf+0xb9/0xf0
      ? __import_iovec+0x254/0x2b0
      ? lock_release+0x62/0x200
      ? __pfx_netlink_sendmsg+0x10/0x10
      ____sys_sendmsg+0x559/0x5a0
      ? __pfx_____sys_sendmsg+0x10/0x10
      ? __pfx_copy_msghdr_from_user+0x10/0x10
      ? rcu_is_watching+0x34/0x60
      ? do_read_fault+0x213/0x4a0
      ? rcu_is_watching+0x34/0x60
      ___sys_sendmsg+0xe4/0x150
      ? __pfx____sys_sendmsg+0x10/0x10
      ? do_fault+0x2cc/0x6f0
      ? handle_pte_fault+0x2e3/0x3d0
      ? __pfx_handle_pte_fault+0x10/0x10
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-993262
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bf40f959");
  # https://lore.kernel.org/linux-cve-announce/2025041611-CVE-2025-22075-11d5@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?af66aae5");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-22075");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-22075");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}