Unity Linux 20.1060a Security Update: kernel (UTSA-2025-993286)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(281058);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/31");

  script_cve_id("CVE-2022-50409");

  script_name(english:"Unity Linux 20.1060a Security Update: kernel (UTSA-2025-993286)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-993286 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

    Fixes the below NULL pointer dereference:

      [...]
      [   14.471200] Call Trace:
      [   14.471562]  <TASK>
      [   14.471882]  lock_acquire+0x245/0x2e0
      [   14.472416]  ? remove_wait_queue+0x12/0x50
      [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50
      [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50
      [   14.474318]  ? remove_wait_queue+0x12/0x50
      [   14.474907]  remove_wait_queue+0x12/0x50
      [   14.475480]  sk_stream_wait_memory+0x20d/0x340
      [   14.476127]  ? do_wait_intr_irq+0x80/0x80
      [   14.476704]  do_tcp_sendpages+0x287/0x600
      [   14.477283]  tcp_bpf_push+0xab/0x260
      [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500
      [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0
      [   14.479096]  tcp_bpf_send_verdict+0x105/0x470
      [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0
      [   14.480311]  sock_sendmsg+0x2d/0x40
      [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0
      [   14.481390]  ? copy_msghdr_from_user+0x62/0x80
      [   14.482048]  ___sys_sendmsg+0x78/0xb0
      [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150
      [   14.483215]  ? __do_fault+0x2a/0x1a0
      [   14.483738]  ? do_fault+0x15e/0x5d0
      [   14.484246]  ? __handle_mm_fault+0x56b/0x1040
      [   14.484874]  ? lock_is_held_type+0xdf/0x130
      [   14.485474]  ? find_held_lock+0x2d/0x90
      [   14.486046]  ? __sys_sendmsg+0x41/0x70
      [   14.486587]  __sys_sendmsg+0x41/0x70
      [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350
      [   14.487822]  do_syscall_64+0x34/0x80
      [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
      [...]

    The test scenario has the following flow:

    thread1                               thread2
    -----------                           ---------------
     tcp_bpf_sendmsg
      tcp_bpf_send_verdict
       tcp_bpf_sendmsg_redir              sock_close
        tcp_bpf_push_locked                 __sock_release
         tcp_bpf_push                         //inet_release
          do_tcp_sendpages                    sock->ops->release
           sk_stream_wait_memory               // tcp_close
              sk_wait_event                      sk->sk_prot->close
               release_sock(__sk);
                ***
                                                    lock_sock(sk);
                                                      __tcp_close
                                                        sock_orphan(sk)
                                                          sk->sk_wq  = NULL
                                                    release_sock
                ****
               lock_sock(__sk);
              remove_wait_queue(sk_sleep(sk), &wait);
                 sk_sleep(sk)
                 //NULL pointer dereference
                 &rcu_dereference_raw(sk->sk_wq)->wait

    While waiting for memory in thread1, the socket is released with its wait
    queue because thread2 has closed it. This caused by tcp_bpf_send_verdict
    didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.

    We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory
    before accessing the wait queue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-993286
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?349cb5d7");
  # https://lore.kernel.org/linux-cve-announce/2025091853-CVE-2022-50409-d7dc@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?07752fb4");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50409");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50409");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}