Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005175)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296962);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/27");

  script_cve_id("CVE-2024-56642");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005175)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005175 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: Fix use-after-free of kernel socket in cleanup_bearer().

    syzkaller reported a use-after-free of UDP kernel socket
    in cleanup_bearer() without repro. [0][1]

    When bearer_disable() calls tipc_udp_disable(), cleanup
    of the UDP kernel socket is deferred by work calling
    cleanup_bearer().

    tipc_exit_net() waits for such works to finish by checking
    tipc_net(net)->wq_count.  However, the work decrements the
    count too early before releasing the kernel socket,
    unblocking cleanup_net() and resulting in use-after-free.

    Let's move the decrement after releasing the socket in
    cleanup_bearer().

    [0]:
    ref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at
         sk_alloc+0x438/0x608
         inet_create+0x4c8/0xcb0
         __sock_create+0x350/0x6b8
         sock_create_kern+0x58/0x78
         udp_sock_create4+0x68/0x398
         udp_sock_create+0x88/0xc8
         tipc_udp_enable+0x5e8/0x848
         __tipc_nl_bearer_enable+0x84c/0xed8
         tipc_nl_bearer_enable+0x38/0x60
         genl_family_rcv_msg_doit+0x170/0x248
         genl_rcv_msg+0x400/0x5b0
         netlink_rcv_skb+0x1dc/0x398
         genl_rcv+0x44/0x68
         netlink_unicast+0x678/0x8b0
         netlink_sendmsg+0x5e4/0x898
         ____sys_sendmsg+0x500/0x830

    [1]:
    BUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline]
    BUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
     udp_hashslot include/net/udp.h:85 [inline]
     udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
     sk_common_release+0xaf/0x3f0 net/core/sock.c:3820
     inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437
     inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489
     __sock_release net/socket.c:658 [inline]
     sock_release+0xa0/0x210 net/socket.c:686
     cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819
     process_one_work kernel/workqueue.c:3229 [inline]
     process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
     worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
     kthread+0x531/0x6b0 kernel/kthread.c:389
     ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

    Uninit was created at:
     slab_free_hook mm/slub.c:2269 [inline]
     slab_free mm/slub.c:4580 [inline]
     kmem_cache_free+0x207/0xc40 mm/slub.c:4682
     net_free net/core/net_namespace.c:454 [inline]
     cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647
     process_one_work kernel/workqueue.c:3229 [inline]
     process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
     worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
     kthread+0x531/0x6b0 kernel/kthread.c:389
     ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

    CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7
    91723d6f74857f70725e1583cba3cf4adc716cfa
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org
    04/01/2014
    Workqueue: events cleanup_bearer

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005175
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dc5d10a7");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-56642");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-56642");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}