Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007453)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307101);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2023-53821");

  script_name(english:"Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007453)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-007453 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6

    When ipv6_vti device is set to the qdisc of the sfb type, the cb field
    of the sent skb may be modified during enqueuing. Then,
    slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.

    The stack information is as follows:
    BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
    Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0
    CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
    Call Trace:
    <IRQ>
    dump_stack_lvl+0xd9/0x150
    print_address_description.constprop.0+0x2c/0x3c0
    kasan_report+0x11d/0x130
    decode_session6+0x103f/0x1890
    __xfrm_decode_session+0x54/0xb0
    vti6_tnl_xmit+0x3e6/0x1ee0
    dev_hard_start_xmit+0x187/0x700
    sch_direct_xmit+0x1a3/0xc30
    __qdisc_run+0x510/0x17a0
    __dev_queue_xmit+0x2215/0x3b10
    neigh_connected_output+0x3c2/0x550
    ip6_finish_output2+0x55a/0x1550
    ip6_finish_output+0x6b9/0x1270
    ip6_output+0x1f1/0x540
    ndisc_send_skb+0xa63/0x1890
    ndisc_send_rs+0x132/0x6f0
    addrconf_rs_timer+0x3f1/0x870
    call_timer_fn+0x1a0/0x580
    expire_timers+0x29b/0x4b0
    run_timer_softirq+0x326/0x910
    __do_softirq+0x1d4/0x905
    irq_exit_rcu+0xb7/0x120
    sysvec_apic_timer_interrupt+0x97/0xc0
    </IRQ>
    Allocated by task 9176:
    kasan_save_stack+0x22/0x40
    kasan_set_track+0x25/0x30
    __kasan_slab_alloc+0x7f/0x90
    kmem_cache_alloc_node+0x1cd/0x410
    kmalloc_reserve+0x165/0x270
    __alloc_skb+0x129/0x330
    netlink_sendmsg+0x9b1/0xe30
    sock_sendmsg+0xde/0x190
    ____sys_sendmsg+0x739/0x920
    ___sys_sendmsg+0x110/0x1b0
    __sys_sendmsg+0xf7/0x1c0
    do_syscall_64+0x39/0xb0
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    Freed by task 9176:
    kasan_save_stack+0x22/0x40
    kasan_set_track+0x25/0x30
    kasan_save_free_info+0x2b/0x40
    ____kasan_slab_free+0x160/0x1c0
    slab_free_freelist_hook+0x11b/0x220
    kmem_cache_free+0xf0/0x490
    skb_free_head+0x17f/0x1b0
    skb_release_data+0x59c/0x850
    consume_skb+0xd2/0x170
    netlink_unicast+0x54f/0x7f0
    netlink_sendmsg+0x926/0xe30
    sock_sendmsg+0xde/0x190
    ____sys_sendmsg+0x739/0x920
    ___sys_sendmsg+0x110/0x1b0
    __sys_sendmsg+0xf7/0x1c0
    do_syscall_64+0x39/0xb0
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    The buggy address belongs to the object at ffff88802e08ed00
    which belongs to the cache skbuff_small_head of size 640
    The buggy address is located 194 bytes inside of
    freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)

    As commit f855691975bb (xfrm6: Fix the nexthdr offset in
    _decode_session6.) showed, xfrm_decode_session was originally intended
    only for the receive path. IP6CB(skb)->nhoff is not set during
    transmission. Therefore, set the cb field in the skb to 0 before
    sending packets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-007453
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6b89a350");
  # https://lore.kernel.org/linux-cve-announce/2025120950-CVE-2023-53821-9542@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?941cc301");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-53821");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-53821");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e|20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.51', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.51', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.51', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.105', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.105', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.105', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2407.1.0', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2407.1.0', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2407.1.0', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2407.1.0', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}