Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011095)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(308891);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/22");

  script_cve_id("CVE-2023-53148");

  script_name(english:"Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011095)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-011095 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Fix igb_down hung on surprise removal

    In a setup where a Thunderbolt hub connects to Ethernet and a display
    through USB Type-C, users may experience a hung task timeout when they
    remove the cable between the PC and the Thunderbolt hub.
    This is because the igb_down function is called multiple times when
    the Thunderbolt hub is unplugged. For example, the igb_io_error_detected
    triggers the first call, and the igb_remove triggers the second call.
    The second call to igb_down will block at napi_synchronize.
    Here's the call trace:
        __schedule+0x3b0/0xddb
        ? __mod_timer+0x164/0x5d3
        schedule+0x44/0xa8
        schedule_timeout+0xb2/0x2a4
        ? run_local_timers+0x4e/0x4e
        msleep+0x31/0x38
        igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]
        __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]
        igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]
        __dev_close_many+0x95/0xec
        dev_close_many+0x6e/0x103
        unregister_netdevice_many+0x105/0x5b1
        unregister_netdevice_queue+0xc2/0x10d
        unregister_netdev+0x1c/0x23
        igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]
        pci_device_remove+0x3f/0x9c
        device_release_driver_internal+0xfe/0x1b4
        pci_stop_bus_device+0x5b/0x7f
        pci_stop_bus_device+0x30/0x7f
        pci_stop_bus_device+0x30/0x7f
        pci_stop_and_remove_bus_device+0x12/0x19
        pciehp_unconfigure_device+0x76/0xe9
        pciehp_disable_slot+0x6e/0x131
        pciehp_handle_presence_or_link_change+0x7a/0x3f7
        pciehp_ist+0xbe/0x194
        irq_thread_fn+0x22/0x4d
        ? irq_thread+0x1fd/0x1fd
        irq_thread+0x17b/0x1fd
        ? irq_forced_thread_fn+0x5f/0x5f
        kthread+0x142/0x153
        ? __irq_get_irqchip_state+0x46/0x46
        ? kthread_associate_blkcg+0x71/0x71
        ret_from_fork+0x1f/0x30

    In this case, igb_io_error_detected detaches the network interface
    and requests a PCIE slot reset, however, the PCIE reset callback is
    not being invoked and thus the Ethernet connection breaks down.
    As the PCIE error in this case is a non-fatal one, requesting a
    slot reset can be avoided.
    This patch fixes the task hung issue and preserves Ethernet
    connection by ignoring non-fatal PCIE errors.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-011095
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?db1be047");
  # https://lore.kernel.org/linux-cve-announce/2025091552-CVE-2023-53148-e1b8@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b6d9ec75");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2023-53148");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-53148");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.7.1', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7.1', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7.1', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.7.1', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}