Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005195)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296958);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/27");

  script_cve_id("CVE-2024-53095");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005195)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005195 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix use-after-free of network namespace.

    Recently, we got a customer report that CIFS triggers oops while
    reconnecting to a server.  [0]

    The workload runs on Kubernetes, and some pods mount CIFS servers
    in non-root network namespaces.  The problem rarely happened, but
    it was always while the pod was dying.

    The root cause is wrong reference counting for network namespace.

    CIFS uses kernel sockets, which do not hold refcnt of the netns that
    the socket belongs to.  That means CIFS must ensure the socket is
    always freed before its netns; otherwise, use-after-free happens.

    The repro steps are roughly:

      1. mount CIFS in a non-root netns
      2. drop packets from the netns
      3. destroy the netns
      4. unmount CIFS

    We can reproduce the issue quickly with the script [1] below and see
    the splat [2] if CONFIG_NET_NS_REFCNT_TRACKER is enabled.

    When the socket is TCP, it is hard to guarantee the netns lifetime
    without holding refcnt due to async timers.

    Let's hold netns refcnt for each socket as done for SMC in commit
    9744d2bf1976 (smc: Fix use-after-free in tcp_write_timer_handler().).

    Note that we need to move put_net() from cifs_put_tcp_session() to
    clean_demultiplex_info(); otherwise, __sock_create() still could touch a
    freed netns while cifsd tries to reconnect from cifs_demultiplex_thread().

    Also, maybe_get_net() cannot be put just before __sock_create() because
    the code is not under RCU and there is a small chance that the same
    address happened to be reallocated to another netns.

    [0]:
    CIFS: VFS: \\XXXXXXXXXXX has not responded in 15 seconds. Reconnecting...
    CIFS: Serverclose failed 4 times, giving up
    Unable to handle kernel paging request at virtual address 14de99e461f84a07
    Mem abort info:
      ESR = 0x0000000096000004
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x04: level 0 translation fault
    Data abort info:
      ISV = 0, ISS = 0x00000004
      CM = 0, WnR = 0
    [14de99e461f84a07] address between user and kernel address ranges
    Internal error: Oops: 0000000096000004 [#1] SMP
    Modules linked in: cls_bpf sch_ingress nls_utf8 cifs cifs_arc4 cifs_md4 dns_resolver tcp_diag inet_diag
    veth xt_state xt_connmark nf_conntrack_netlink xt_nat xt_statistic xt_MASQUERADE xt_mark xt_addrtype
    ipt_REJECT nf_reject_ipv4 nft_chain_nat nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
    xt_comment nft_compat nf_tables nfnetlink overlay nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk
    aes_ce_cipher ghash_ce sm4_ce_cipher sm4 sm3_ce sm3 sha3_ce sha512_ce sha512_arm64 sha1_ce ena button
    sch_fq_codel loop fuse configfs dmi_sysfs sha2_ce sha256_arm64 dm_mirror dm_region_hash dm_log dm_mod dax
    efivarfs
    CPU: 5 PID: 2690970 Comm: cifsd Not tainted 6.1.103-109.184.amzn2023.aarch64 #1
    Hardware name: Amazon EC2 r7g.4xlarge/, BIOS 1.0 11/1/2018
    pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : fib_rules_lookup+0x44/0x238
    lr : __fib_lookup+0x64/0xbc
    sp : ffff8000265db790
    x29: ffff8000265db790 x28: 0000000000000000 x27: 000000000000bd01
    x26: 0000000000000000 x25: ffff000b4baf8000 x24: ffff00047b5e4580
    x23: ffff8000265db7e0 x22: 0000000000000000 x21: ffff00047b5e4500
    x20: ffff0010e3f694f8 x19: 14de99e461f849f7 x18: 0000000000000000
    x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
    x14: 0000000000000000 x13: 0000000000000000 x12: 3f92800abd010002
    x11: 0000000000000001 x10: ffff0010e3f69420 x9 : ffff800008a6f294
    x8 : 0000000000000000 x7 : 0000000000000006 x6 : 0000000000000000
    x5 : 0000000000000001 x4 : ffff001924354280 x3 : ffff8000265db7e0
    x2 : 0000000000000000 x1 : ffff0010e3f694f8 x0 : ffff00047b5e4500
    Call trace:
     fib_rules_lookup+0x44/0x238
     __fib_lookup+0x64/0xbc
     ip_route_output_key_hash_rcu+0x2c4/0x398
     ip_route_output_key_hash+0x60/0x8c
     tcp_v4_connect+0x290/0x488
     __inet_stream_connect+0x108/0x3d0
     inet_stream_connect+0x50/0x78
     kernel_connect+0x6c/0xac
     generic_ip_conne
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005195
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b0a8917");
  # https://lore.kernel.org/linux-cve-announce/2024112152-CVE-2024-53095-7ffd@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f77326e");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-53095");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-53095");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}