Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005031)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296708);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/27");

  script_cve_id("CVE-2021-47544");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005031)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005031 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix page frag corruption on page fault

    Steffen reported a TCP stream corruption for HTTP requests
    served by the apache web-server using a cifs mount-point
    and memory mapping the relevant file.

    The root cause is quite similar to the one addressed by
    commit 20eb4f29b602 (net: fix sk_page_frag() recursion from
    memory reclaim). Here the nested access to the task page frag
    is caused by a page fault on the (mmapped) user-space memory
    buffer coming from the cifs file.

    The page fault handler performs an smb transaction on a different
    socket, inside the same process context. Since sk->sk_allaction
    for such socket does not prevent the usage for the task_frag,
    the nested allocation modify under the hood the page frag
    in use by the outer sendmsg call, corrupting the stream.

    The overall relevant stack trace looks like the following:

    httpd 78268 [001] 3461630.850950:      probe:tcp_sendmsg_locked:
            ffffffff91461d91 tcp_sendmsg_locked+0x1
            ffffffff91462b57 tcp_sendmsg+0x27
            ffffffff9139814e sock_sendmsg+0x3e
            ffffffffc06dfe1d smb_send_kvec+0x28
            [...]
            ffffffffc06cfaf8 cifs_readpages+0x213
            ffffffff90e83c4b read_pages+0x6b
            ffffffff90e83f31 __do_page_cache_readahead+0x1c1
            ffffffff90e79e98 filemap_fault+0x788
            ffffffff90eb0458 __do_fault+0x38
            ffffffff90eb5280 do_fault+0x1a0
            ffffffff90eb7c84 __handle_mm_fault+0x4d4
            ffffffff90eb8093 handle_mm_fault+0xc3
            ffffffff90c74f6d __do_page_fault+0x1ed
            ffffffff90c75277 do_page_fault+0x37
            ffffffff9160111e page_fault+0x1e
            ffffffff9109e7b5 copyin+0x25
            ffffffff9109eb40 _copy_from_iter_full+0xe0
            ffffffff91462370 tcp_sendmsg_locked+0x5e0
            ffffffff91462370 tcp_sendmsg_locked+0x5e0
            ffffffff91462b57 tcp_sendmsg+0x27
            ffffffff9139815c sock_sendmsg+0x4c
            ffffffff913981f7 sock_write_iter+0x97
            ffffffff90f2cc56 do_iter_readv_writev+0x156
            ffffffff90f2dff0 do_iter_write+0x80
            ffffffff90f2e1c3 vfs_writev+0xa3
            ffffffff90f2e27c do_writev+0x5c
            ffffffff90c042bb do_syscall_64+0x5b
            ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65

    The cifs filesystem rightfully sets sk_allocations to GFP_NOFS,
    we can avoid the nesting using the sk page frag for allocation
    lacking the __GFP_FS flag. Do not define an additional mm-helper
    for that, as this is strictly tied to the sk page frag usage.

    v1 -> v2:
     - use a stricted sk_page_frag() check instead of reordering the
       code (Eric)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005031
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11d4f594");
  # https://lore.kernel.org/linux-cve-announce/2024052440-CVE-2021-47544-ceb5@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e9a907f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2021-47544");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-47544");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}