Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013158)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(308052);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2022-50849");

  script_name(english:"Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013158)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-013158 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP

    An oops can be induced by running 'cat /proc/kcore > /dev/null' on
    devices using pstore with the ram backend because kmap_atomic() assumes
    lowmem pages are accessible with __va().

     Unable to handle kernel paging request at virtual address ffffff807ff2b000
     Mem abort info:
     ESR = 0x96000006
     EC = 0x25: DABT (current EL), IL = 32 bits
     SET = 0, FnV = 0
     EA = 0, S1PTW = 0
     FSC = 0x06: level 2 translation fault
     Data abort info:
     ISV = 0, ISS = 0x00000006
     CM = 0, WnR = 0
     swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000
     [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000
     Internal error: Oops: 96000006 [#1] PREEMPT SMP
     Modules linked in: dm_integrity
     CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1
    baa443fb8e8477896a370b31a821eb2009f9bfba
     Hardware name: Google Lazor (rev3 - 8) (DT)
     pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : __memcpy+0x110/0x260
     lr : vread+0x194/0x294
     sp : ffffffc013ee39d0
     x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000
     x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000
     x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000
     x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000
     x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60
     x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001
     x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b
     x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000
     x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78
     x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000
     Call trace:
     __memcpy+0x110/0x260
     read_kcore+0x584/0x778
     proc_reg_read+0xb4/0xe4

    During early boot, memblock reserves the pages for the ramoops reserved
    memory node in DT that would otherwise be part of the direct lowmem
    mapping. Pstore's ram backend reuses those reserved pages to change the
    memory type (writeback or non-cached) by passing the pages to vmap()
    (see pfn_to_page() usage in persistent_ram_vmap() for more details) with
    specific flags. When read_kcore() starts iterating over the vmalloc
    region, it runs over the virtual address that vmap() returned for
    ramoops. In aligned_vread() the virtual address is passed to
    vmalloc_to_page() which returns the page struct for the reserved lowmem
    area. That lowmem page is passed to kmap_atomic(), which effectively
    calls page_to_virt() that assumes a lowmem page struct must be directly
    accessible with __va() and friends. These pages are mapped via vmap()
    though, and the lowmem mapping was never made, so accessing them via the
    lowmem virtual address oopses like above.

    Let's side-step this problem by passing VM_IOREMAP to vmap(). This will
    tell vread() to not include the ramoops region in the kcore. Instead the
    area will look like a bunch of zeros. The alternative is to teach kmap()
    about vmalloc areas that intersect with lowmem. Presumably such a change
    isn't a one-liner, and there isn't much interest in inspecting the
    ramoops region in kcore files anyway, so the most expedient route is
    taken for now.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-013158
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f93bab4");
  # https://lore.kernel.org/linux-cve-announce/2025123044-CVE-2022-50849-9dea@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c20c1717");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50849");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50849");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2302.3.0', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}