Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007565)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307091);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2021-46961");

  script_name(english:"Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007565)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-007565 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Do not enable irqs when handling spurious interrups

    We triggered the following error while running our 4.19 kernel
    with the pseudo-NMI patches backported to it:

    [   14.816231] ------------[ cut here ]------------
    [   14.816231] kernel BUG at irq.c:99!
    [   14.816232] Internal error: Oops - BUG: 0 [#1] SMP
    [   14.816232] Process swapper/0 (pid: 0, stack limit = 0x(____ptrval____))
    [   14.816233] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      4.19.95.aarch64 #14
    [   14.816233] Hardware name: evb (DT)
    [   14.816234] pstate: 80400085 (Nzcv daIf +PAN -UAO)
    [   14.816234] pc : asm_nmi_enter+0x94/0x98
    [   14.816235] lr : asm_nmi_enter+0x18/0x98
    [   14.816235] sp : ffff000008003c50
    [   14.816235] pmr_save: 00000070
    [   14.816237] x29: ffff000008003c50 x28: ffff0000095f56c0
    [   14.816238] x27: 0000000000000000 x26: ffff000008004000
    [   14.816239] x25: 00000000015e0000 x24: ffff8008fb916000
    [   14.816240] x23: 0000000020400005 x22: ffff0000080817cc
    [   14.816241] x21: ffff000008003da0 x20: 0000000000000060
    [   14.816242] x19: 00000000000003ff x18: ffffffffffffffff
    [   14.816243] x17: 0000000000000008 x16: 003d090000000000
    [   14.816244] x15: ffff0000095ea6c8 x14: ffff8008fff5ab40
    [   14.816244] x13: ffff8008fff58b9d x12: 0000000000000000
    [   14.816245] x11: ffff000008c8a200 x10: 000000008e31fca5
    [   14.816246] x9 : ffff000008c8a208 x8 : 000000000000000f
    [   14.816247] x7 : 0000000000000004 x6 : ffff8008fff58b9e
    [   14.816248] x5 : 0000000000000000 x4 : 0000000080000000
    [   14.816249] x3 : 0000000000000000 x2 : 0000000080000000
    [   14.816250] x1 : 0000000000120000 x0 : ffff0000095f56c0
    [   14.816251] Call trace:
    [   14.816251]  asm_nmi_enter+0x94/0x98
    [   14.816251]  el1_irq+0x8c/0x180                    (IRQ C)
    [   14.816252]  gic_handle_irq+0xbc/0x2e4
    [   14.816252]  el1_irq+0xcc/0x180                    (IRQ B)
    [   14.816253]  arch_timer_handler_virt+0x38/0x58
    [   14.816253]  handle_percpu_devid_irq+0x90/0x240
    [   14.816253]  generic_handle_irq+0x34/0x50
    [   14.816254]  __handle_domain_irq+0x68/0xc0
    [   14.816254]  gic_handle_irq+0xf8/0x2e4
    [   14.816255]  el1_irq+0xcc/0x180                    (IRQ A)
    [   14.816255]  arch_cpu_idle+0x34/0x1c8
    [   14.816255]  default_idle_call+0x24/0x44
    [   14.816256]  do_idle+0x1d0/0x2c8
    [   14.816256]  cpu_startup_entry+0x28/0x30
    [   14.816256]  rest_init+0xb8/0xc8
    [   14.816257]  start_kernel+0x4c8/0x4f4
    [   14.816257] Code: 940587f1 d5384100 b9401001 36a7fd01 (d4210000)
    [   14.816258] Modules linked in: start_dp(O) smeth(O)
    [   15.103092] ---[ end trace 701753956cb14aa8 ]---
    [   15.103093] Kernel panic - not syncing: Fatal exception in interrupt
    [   15.103099] SMP: stopping secondary CPUs
    [   15.103100] Kernel Offset: disabled
    [   15.103100] CPU features: 0x36,a2400218
    [   15.103100] Memory Limit: none

    which is cause by a 'BUG_ON(in_nmi())' in nmi_enter().

    From the call trace, we can find three interrupts (noted A, B, C above):
    interrupt (A) is preempted by (B), which is further interrupted by (C).

    Subsequent investigations show that (B) results in nmi_enter() being
    called, but that it actually is a spurious interrupt. Furthermore,
    interrupts are reenabled in the context of (B), and (C) fires with
    NMI priority. We end-up with a nested NMI situation, something
    we definitely do not want to (and cannot) handle.

    The bug here is that spurious interrupts should never result in any
    state change, and we should just return to the interrupted context.
    Moving the handling of spurious interrupts as early as possible in
    the GICv3 handler fixes this issue.

    [maz: rewrote commit message, corrected Fixes: tag]

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-007565
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?01a22662");
  # https://lore.kernel.org/linux-cve-announce/2024022719-CVE-2021-46961-6212@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?16acd4b1");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2021-46961");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-46961");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e|20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2104.22.0', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}