Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005093)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296883);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/27");

  script_cve_id("CVE-2024-42311");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005093)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005093 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()

    Syzbot reports uninitialized value access issue as below:

    loop0: detected capacity change from 0 to 64
    =====================================================
    BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30
     hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30
     d_revalidate fs/namei.c:862 [inline]
     lookup_fast+0x89e/0x8e0 fs/namei.c:1649
     walk_component fs/namei.c:2001 [inline]
     link_path_walk+0x817/0x1480 fs/namei.c:2332
     path_lookupat+0xd9/0x6f0 fs/namei.c:2485
     filename_lookup+0x22e/0x740 fs/namei.c:2515
     user_path_at_empty+0x8b/0x390 fs/namei.c:2924
     user_path_at include/linux/namei.h:57 [inline]
     do_mount fs/namespace.c:3689 [inline]
     __do_sys_mount fs/namespace.c:3898 [inline]
     __se_sys_mount+0x66b/0x810 fs/namespace.c:3875
     __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b

    BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]
    BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366
     hfs_ext_read_extent fs/hfs/extent.c:196 [inline]
     hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366
     block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271
     hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39
     filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426
     do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553
     do_read_cache_page mm/filemap.c:3595 [inline]
     read_cache_page+0xfb/0x2f0 mm/filemap.c:3604
     read_mapping_page include/linux/pagemap.h:755 [inline]
     hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78
     hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204
     hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406
     mount_bdev+0x628/0x920 fs/super.c:1359
     hfs_mount+0xcd/0xe0 fs/hfs/super.c:456
     legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610
     vfs_get_tree+0xdc/0x5d0 fs/super.c:1489
     do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145
     path_mount+0xf98/0x26a0 fs/namespace.c:3475
     do_mount fs/namespace.c:3488 [inline]
     __do_sys_mount fs/namespace.c:3697 [inline]
     __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674
     __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674
     do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
     __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
     do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
     do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
     entry_SYSENTER_compat_after_hwframe+0x70/0x82

    Uninit was created at:
     __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590
     __alloc_pages_node include/linux/gfp.h:238 [inline]
     alloc_pages_node include/linux/gfp.h:261 [inline]
     alloc_slab_page mm/slub.c:2190 [inline]
     allocate_slab mm/slub.c:2354 [inline]
     new_slab+0x2d7/0x1400 mm/slub.c:2407
     ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540
     __slab_alloc mm/slub.c:3625 [inline]
     __slab_alloc_node mm/slub.c:3678 [inline]
     slab_alloc_node mm/slub.c:3850 [inline]
     kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879
     alloc_inode_sb include/linux/fs.h:3018 [inline]
     hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165
     alloc_inode+0x83/0x440 fs/inode.c:260
     new_inode_pseudo fs/inode.c:1005 [inline]
     new_inode+0x38/0x4f0 fs/inode.c:1031
     hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186
     hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228
     vfs_mkdir+0x49a/0x700 fs/namei.c:4126
     do_mkdirat+0x529/0x810 fs/namei.c:4149
     __do_sys_mkdirat fs/namei.c:4164 [inline]
     __se_sys_mkdirat fs/namei.c:4162 [inline]
     __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b

    It missed to initialize .tz_secondswest, .cached_start and .cached_blocks
    fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005093
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8d60aff8");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-42311");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-42311");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}