Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003629)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(288311);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/10");

  script_cve_id("CVE-2018-8897");

  script_name(english:"Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003629)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-003629 advisory.

    A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's
    Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in
    unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for
    example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel
    crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and
    single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS
    instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF)
    system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS
    instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating
    system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels
    may not expect this order of events and may therefore experience unexpected behavior when it occurs.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-003629
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?37ac47bc");
  # http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?45707cda");
  script_set_attribute(attribute:"see_also", value:"http://openwall.com/lists/oss-security/2018/05/08/1");
  script_set_attribute(attribute:"see_also", value:"http://openwall.com/lists/oss-security/2018/05/08/4");
  # http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2fb42aa9");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/104071");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040744");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040849");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040861");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040866");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1040882");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1318");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1319");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1345");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1346");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1347");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1348");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1349");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1350");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1351");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1352");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1353");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1354");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1355");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:1524");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1567074");
  script_set_attribute(attribute:"see_also", value:"https://github.com/can1357/CVE-2018-8897/");
  # https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?21d38445");
  # https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?148b2157");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html");
  script_set_attribute(attribute:"see_also", value:"https://patchwork.kernel.org/patch/10386677/");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?659953a0");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2018-8897");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20180927-0002/");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/HT208742");
  script_set_attribute(attribute:"see_also", value:"https://support.citrix.com/article/CTX234679");
  script_set_attribute(attribute:"see_also", value:"https://svnweb.freebsd.org/base?view=revision&revision=333368");
  script_set_attribute(attribute:"see_also", value:"https://usn.ubuntu.com/3641-1/");
  script_set_attribute(attribute:"see_also", value:"https://usn.ubuntu.com/3641-2/");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2018/dsa-4196");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2018/dsa-4201");
  script_set_attribute(attribute:"see_also", value:"https://www.exploit-db.com/exploits/44697/");
  script_set_attribute(attribute:"see_also", value:"https://www.exploit-db.com/exploits/45024/");
  # https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2846adde");
  script_set_attribute(attribute:"see_also", value:"https://www.kb.cert.org/vuls/id/631579");
  script_set_attribute(attribute:"see_also", value:"https://www.synology.com/support/security/Synology_SA_18_21");
  # https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5fe0ae35");
  script_set_attribute(attribute:"see_also", value:"https://xenbits.xen.org/xsa/advisory-260.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8897");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.5', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}