Unity Linux 20.1050a Security Update: kernel (UTSA-2026-007028)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(308181);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2023-53500");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-007028)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-007028 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6

    When the xfrm device is set to the qdisc of the sfb type, the cb field
    of the sent skb may be modified during enqueuing. Then,
    slab-use-after-free may occur when the xfrm device sends IPv6 packets.

    The stack information is as follows:
    BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
    Read of size 1 at addr ffff8881111458ef by task swapper/3/0
    CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
    Call Trace:
    <IRQ>
    dump_stack_lvl+0xd9/0x150
    print_address_description.constprop.0+0x2c/0x3c0
    kasan_report+0x11d/0x130
    decode_session6+0x103f/0x1890
    __xfrm_decode_session+0x54/0xb0
    xfrmi_xmit+0x173/0x1ca0
    dev_hard_start_xmit+0x187/0x700
    sch_direct_xmit+0x1a3/0xc30
    __qdisc_run+0x510/0x17a0
    __dev_queue_xmit+0x2215/0x3b10
    neigh_connected_output+0x3c2/0x550
    ip6_finish_output2+0x55a/0x1550
    ip6_finish_output+0x6b9/0x1270
    ip6_output+0x1f1/0x540
    ndisc_send_skb+0xa63/0x1890
    ndisc_send_rs+0x132/0x6f0
    addrconf_rs_timer+0x3f1/0x870
    call_timer_fn+0x1a0/0x580
    expire_timers+0x29b/0x4b0
    run_timer_softirq+0x326/0x910
    __do_softirq+0x1d4/0x905
    irq_exit_rcu+0xb7/0x120
    sysvec_apic_timer_interrupt+0x97/0xc0
    </IRQ>
    <TASK>
    asm_sysvec_apic_timer_interrupt+0x1a/0x20
    RIP: 0010:intel_idle_hlt+0x23/0x30
    Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f
    ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4
    RSP: 0018:ffffc90000197d78 EFLAGS: 00000246
    RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5
    RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50
    RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d
    R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001
    R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000
    cpuidle_enter_state+0xd3/0x6f0
    cpuidle_enter+0x4e/0xa0
    do_idle+0x2fe/0x3c0
    cpu_startup_entry+0x18/0x20
    start_secondary+0x200/0x290
    secondary_startup_64_no_verify+0x167/0x16b
    </TASK>
    Allocated by task 939:
    kasan_save_stack+0x22/0x40
    kasan_set_track+0x25/0x30
    __kasan_slab_alloc+0x7f/0x90
    kmem_cache_alloc_node+0x1cd/0x410
    kmalloc_reserve+0x165/0x270
    __alloc_skb+0x129/0x330
    inet6_ifa_notify+0x118/0x230
    __ipv6_ifa_notify+0x177/0xbe0
    addrconf_dad_completed+0x133/0xe00
    addrconf_dad_work+0x764/0x1390
    process_one_work+0xa32/0x16f0
    worker_thread+0x67d/0x10c0
    kthread+0x344/0x440
    ret_from_fork+0x1f/0x30
    The buggy address belongs to the object at ffff888111145800
    which belongs to the cache skbuff_small_head of size 640
    The buggy address is located 239 bytes inside of
    freed 640-byte region [ffff888111145800, ffff888111145a80)

    As commit f855691975bb (xfrm6: Fix the nexthdr offset in
    _decode_session6.) showed, xfrm_decode_session was originally intended
    only for the receive path. IP6CB(skb)->nhoff is not set during
    transmission. Therefore, set the cb field in the skb to 0 before
    sending packets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-007028
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e58f53e1");
  # https://lore.kernel.org/linux-cve-announce/2025100126-CVE-2023-53500-61b6@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be92e24f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-53500");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-53500");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}