Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013018)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307781);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2022-50516");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013018)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-013018 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs: dlm: fix invalid derefence of sb_lvbptr

    I experience issues when putting a lkbsb on the stack and have sb_lvbptr
    field to a dangled pointer while not using DLM_LKF_VALBLK. It will crash
    with the following kernel message, the dangled pointer is here
    0xdeadbeef as example:

    [  102.749317] BUG: unable to handle page fault for address: 00000000deadbeef
    [  102.749320] #PF: supervisor read access in kernel mode
    [  102.749323] #PF: error_code(0x0000) - not-present page
    [  102.749325] PGD 0 P4D 0
    [  102.749332] Oops: 0000 [#1] PREEMPT SMP PTI
    [  102.749336] CPU: 0 PID: 1567 Comm: lock_torture_wr Tainted: G        W         5.19.0-rc3+ #1565
    [  102.749343] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014
    [  102.749344] RIP: 0010:memcpy_erms+0x6/0x10
    [  102.749353] Code: cc cc cc cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3
    a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38
    fe
    [  102.749355] RSP: 0018:ffff97a58145fd08 EFLAGS: 00010202
    [  102.749358] RAX: ffff901778b77070 RBX: 0000000000000000 RCX: 0000000000000040
    [  102.749360] RDX: 0000000000000040 RSI: 00000000deadbeef RDI: ffff901778b77070
    [  102.749362] RBP: ffff97a58145fd10 R08: ffff901760b67a70 R09: 0000000000000001
    [  102.749364] R10: ffff9017008e2cb8 R11: 0000000000000001 R12: ffff901760b67a70
    [  102.749366] R13: ffff901760b78f00 R14: 0000000000000003 R15: 0000000000000001
    [  102.749368] FS:  0000000000000000(0000) GS:ffff901876e00000(0000) knlGS:0000000000000000
    [  102.749372] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  102.749374] CR2: 00000000deadbeef CR3: 000000017c49a004 CR4: 0000000000770ef0
    [  102.749376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [  102.749378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [  102.749379] PKRU: 55555554
    [  102.749381] Call Trace:
    [  102.749382]  <TASK>
    [  102.749383]  ? send_args+0xb2/0xd0
    [  102.749389]  send_common+0xb7/0xd0
    [  102.749395]  _unlock_lock+0x2c/0x90
    [  102.749400]  unlock_lock.isra.56+0x62/0xa0
    [  102.749405]  dlm_unlock+0x21e/0x330
    [  102.749411]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]
    [  102.749416]  torture_unlock+0x5a/0x90 [dlm_locktorture]
    [  102.749419]  ? preempt_count_sub+0xba/0x100
    [  102.749427]  lock_torture_writer+0xbd/0x150 [dlm_locktorture]
    [  102.786186]  kthread+0x10a/0x130
    [  102.786581]  ? kthread_complete_and_exit+0x20/0x20
    [  102.787156]  ret_from_fork+0x22/0x30
    [  102.787588]  </TASK>
    [  102.787855] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common
    kvm_intel iTCO_wdt iTCO_vendor_support kvm vmw_vsock_virtio_transport qxl irqbypass
    vmw_vsock_virtio_transport_common drm_ttm_helper crc32_pclmul joydev crc32c_intel ttm vsock virtio_scsi
    virtio_balloon snd_pcm drm_kms_helper virtio_console snd_timer snd drm soundcore syscopyarea i2c_i801
    sysfillrect sysimgblt i2c_smbus pcspkr fb_sys_fops lpc_ich serio_raw
    [  102.792536] CR2: 00000000deadbeef
    [  102.792930] ---[ end trace 0000000000000000 ]---

    This patch fixes the issue by checking also on DLM_LKF_VALBLK on exflags
    is set when copying the lvbptr array instead of if it's just null which
    fixes for me the issue.

    I think this patch can fix other dlm users as well, depending how they
    handle the init, freeing memory handling of sb_lvbptr and don't set
    DLM_LKF_VALBLK for some dlm_lock() calls. It might a there could be a
    hidden issue all the time. However with checking on DLM_LKF_VALBLK the
    user always need to provide a sb_lvbptr non-null value. There might be
    more intelligent handling between per ls lvblen, DLM_LKF_VALBLK and
    non-null to report the user the way how DLM API is used is wrong but can
    be added for later, this will only fix the current behaviour.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-013018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?952af957");
  # https://lore.kernel.org/linux-cve-announce/2025100703-CVE-2022-50516-3b07@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2c1609ec");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50516");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50516");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}