Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006710)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(305520);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/08");

  script_cve_id("CVE-2025-39756");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006710)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-006710 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Prevent file descriptor table allocations exceeding INT_MAX

    When sysctl_nr_open is set to a very high value (for example, 1073741816
    as set by systemd), processes attempting to use file descriptors near
    the limit can trigger massive memory allocation attempts that exceed
    INT_MAX, resulting in a WARNING in mm/slub.c:

      WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288

    This happens because kvmalloc_array() and kvmalloc() check if the
    requested size exceeds INT_MAX and emit a warning when the allocation is
    not flagged with __GFP_NOWARN.

    Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a
    process calls dup2(oldfd, 1073741880), the kernel attempts to allocate:
    - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes
    - Multiple bitmaps: ~400MB
    - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)

    Reproducer:
    1. Set /proc/sys/fs/nr_open to 1073741816:
       # echo 1073741816 > /proc/sys/fs/nr_open

    2. Run a program that uses a high file descriptor:
       #include <unistd.h>
       #include <sys/resource.h>

       int main() {
           struct rlimit rlim = {1073741824, 1073741824};
           setrlimit(RLIMIT_NOFILE, &rlim);
           dup2(2, 1073741880);  // Triggers the warning
           return 0;
       }

    3. Observe WARNING in dmesg at mm/slub.c:5027

    systemd commit a8b627a introduced automatic bumping of fs.nr_open to the
    maximum possible value. The rationale was that systems with memory
    control groups (memcg) no longer need separate file descriptor limits
    since memory is properly accounted. However, this change overlooked
    that:

    1. The kernel's allocation functions still enforce INT_MAX as a maximum
       size regardless of memcg accounting
    2. Programs and tests that legitimately test file descriptor limits can
       inadvertently trigger massive allocations
    3. The resulting allocations (>8GB) are impractical and will always fail

    systemd's algorithm starts with INT_MAX and keeps halving the value
    until the kernel accepts it. On most systems, this results in nr_open
    being set to 1073741816 (0x3ffffff8), which is just under 1GB of file
    descriptors.

    While processes rarely use file descriptors near this limit in normal
    operation, certain selftests (like
    tools/testing/selftests/core/unshare_test.c) and programs that test file
    descriptor limits can trigger this issue.

    Fix this by adding a check in alloc_fdtable() to ensure the requested
    allocation size does not exceed INT_MAX. This causes the operation to
    fail with -EMFILE instead of triggering a kernel warning and avoids the
    impractical >8GB memory allocation request.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-006710
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7ec55de");
  # https://lore.kernel.org/linux-cve-announce/2025091144-CVE-2025-39756-6e90@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bd24b128");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-39756");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39756");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}