Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005505)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300614);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/04");

  script_cve_id("CVE-2023-53215");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005505)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005505 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Don't balance task to its current running CPU

    We've run into the case that the balancer tries to balance a migration
    disabled task and trigger the warning in set_task_cpu() like below:

     ------------[ cut here ]------------
     WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240
     Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip>
     CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G           O       6.1.0-rc4+ #1
     Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021
     pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : set_task_cpu+0x188/0x240
     lr : load_balance+0x5d0/0xc60
     sp : ffff80000803bc70
     x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040
     x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001
     x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78
     x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000
     x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000
     x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000
     x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530
     x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e
     x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a
     x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001
     Call trace:
      set_task_cpu+0x188/0x240
      load_balance+0x5d0/0xc60
      rebalance_domains+0x26c/0x380
      _nohz_idle_balance.isra.0+0x1e0/0x370
      run_rebalance_domains+0x6c/0x80
      __do_softirq+0x128/0x3d8
      ____do_softirq+0x18/0x24
      call_on_irq_stack+0x2c/0x38
      do_softirq_own_stack+0x24/0x3c
      __irq_exit_rcu+0xcc/0xf4
      irq_exit_rcu+0x18/0x24
      el1_interrupt+0x4c/0xe4
      el1h_64_irq_handler+0x18/0x2c
      el1h_64_irq+0x74/0x78
      arch_cpu_idle+0x18/0x4c
      default_idle_call+0x58/0x194
      do_idle+0x244/0x2b0
      cpu_startup_entry+0x30/0x3c
      secondary_start_kernel+0x14c/0x190
      __secondary_switched+0xb0/0xb4
     ---[ end trace 0000000000000000 ]---

    Further investigation shows that the warning is superfluous, the migration
    disabled task is just going to be migrated to its current running CPU.
    This is because that on load balance if the dst_cpu is not allowed by the
    task, we'll re-select a new_dst_cpu as a candidate. If no task can be
    balanced to dst_cpu we'll try to balance the task to the new_dst_cpu
    instead. In this case when the migration disabled task is not on CPU it
    only allows to run on its current CPU, load balance will select its
    current CPU as new_dst_cpu and later triggers the warning above.

    The new_dst_cpu is chosen from the env->dst_grpmask. Currently it
    contains CPUs in sched_group_span() and if we have overlapped groups it's
    possible to run into this case. This patch makes env->dst_grpmask of
    group_balance_mask() which exclude any CPUs from the busiest group and
    solve the issue. For balancing in a domain with no overlapped groups
    the behaviour keeps same as before.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005505
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e3326af");
  # https://lore.kernel.org/linux-cve-announce/2025091511-CVE-2023-53215-8895@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9ea60370");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-53215");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-53215");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.7', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}