Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011069)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(308933);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2022-50782");

  script_name(english:"Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011069)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-011069 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug_on in __es_tree_search caused by bad quota inode

    We got a issue as fllows:
    ==================================================================
     kernel BUG at fs/ext4/extents_status.c:202!
     invalid opcode: 0000 [#1] PREEMPT SMP
     CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352
     RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0
     RSP: 0018:ffffc90001227900 EFLAGS: 00010202
     RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000
     RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8
     RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001
     R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10
     R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000
     FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
     Call Trace:
      <TASK>
      ext4_es_cache_extent+0xe2/0x210
      ext4_cache_extents+0xd2/0x110
      ext4_find_extent+0x5d5/0x8c0
      ext4_ext_map_blocks+0x9c/0x1d30
      ext4_map_blocks+0x431/0xa50
      ext4_getblk+0x82/0x340
      ext4_bread+0x14/0x110
      ext4_quota_read+0xf0/0x180
      v2_read_header+0x24/0x90
      v2_check_quota_file+0x2f/0xa0
      dquot_load_quota_sb+0x26c/0x760
      dquot_load_quota_inode+0xa5/0x190
      ext4_enable_quotas+0x14c/0x300
      __ext4_fill_super+0x31cc/0x32c0
      ext4_fill_super+0x115/0x2d0
      get_tree_bdev+0x1d2/0x360
      ext4_get_tree+0x19/0x30
      vfs_get_tree+0x26/0xe0
      path_mount+0x81d/0xfc0
      do_mount+0x8d/0xc0
      __x64_sys_mount+0xc0/0x160
      do_syscall_64+0x35/0x80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      </TASK>
    ==================================================================

    Above issue may happen as follows:
    -------------------------------------
    ext4_fill_super
     ext4_orphan_cleanup
      ext4_enable_quotas
       ext4_quota_enable
        ext4_iget --> get error inode <5>
         ext4_ext_check_inode --> Wrong imode makes it escape inspection
         make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode
        dquot_load_quota_inode
         vfs_setup_quota_inode --> check pass
         dquot_load_quota_sb
          v2_check_quota_file
           v2_read_header
            ext4_quota_read
             ext4_bread
              ext4_getblk
               ext4_map_blocks
                ext4_ext_map_blocks
                 ext4_find_extent
                  ext4_cache_extents
                   ext4_es_cache_extent
                    __es_tree_search.isra.0
                     ext4_es_end --> Wrong extents trigger BUG_ON

    In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains
    incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO,
    the ext4_ext_check_inode check in the ext4_iget function can be bypassed,
    finally, the extents that are not checked trigger the BUG_ON in the
    __es_tree_search function. To solve this issue, check whether the inode is
    bad_inode in vfs_setup_quota_inode().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-011069
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?68dbc499");
  # https://lore.kernel.org/linux-cve-announce/2025122402-CVE-2022-50782-d849@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?32c0d584");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50782");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50782");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-5.10.0-38', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1060e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-38', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-38', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}