Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005776)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300671);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/04");

  script_cve_id("CVE-2023-53343");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005776)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005776 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

    With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
    has the link-local address as src and dst IP and will be forwarded to
    an external IP in the IPv6 Ext Hdr.

    For example, the script below generates a packet whose src IP is the
    link-local address and dst is updated to 11::.

      # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
      # python3
      >>> from socket import *
      >>> from scapy.all import *
      >>>
      >>> SRC_ADDR = DST_ADDR = fe80::5054:ff:fe12:3456
      >>>
      >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
      >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=[11::, 22::], segleft=1)
      >>>
      >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
      >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))

    For such a packet, we call ip6_route_input() to look up a route for the
    next destination in these three functions depending on the header type.

      * ipv6_rthdr_rcv()
      * ipv6_rpl_srh_rcv()
      * ipv6_srh_rcv()

    If no route is found, ip6_null_entry is set to skb, and the following
    dst_input(skb) calls ip6_pkt_drop().

    Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
    as the input device is the loopback interface.  Then, we have to check if
    skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
    for ip6_null_entry.

    BUG: kernel NULL pointer dereference, address: 0000000000000000
     PF: supervisor read access in kernel mode
     PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    Oops: 0000 [#1] PREEMPT SMP PTI
    CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org
    04/01/2014
    RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
    Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb
    ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
    RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
    RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
    RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
    RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
    R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
    R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
    FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
    PKRU: 55555554
    Call Trace:
     <IRQ>
     ip6_pkt_drop (net/ipv6/route.c:4513)
     ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
     ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
     ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
     __netif_receive_skb_one_core (net/core/dev.c:5455)
     process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
     __napi_poll (net/core/dev.c:6460)
     net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
     __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207
    ./include/trace/events/irq.h:142 kernel/softirq.c:554)
     do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
     </IRQ>
     <TASK>
     __local_bh_enable_ip (kernel/softirq.c:381)
     __dev_queue_xmit (net/core/dev.c:4231)
     ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
     rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656
    net/ipv6/raw.c:914)
     sock_sendmsg (net/socket.c:725 net/socket.c:748)
     __sys_sendto (net/socket.c:2134)
     __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
     do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
    RIP: 0033:0x7f9dc751baea
    Code: d8 64 89 02 48 c7 c0 ff f
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005776
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2b819809");
  # https://lore.kernel.org/linux-cve-announce/2025091719-CVE-2023-53343-880b@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cbabdc3b");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-53343");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-53343");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.190.007', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.007', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.007', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}