Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013786)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(309226);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/26");

  script_cve_id("CVE-2022-50647");

  script_name(english:"Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013786)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-013786 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    RISC-V: Make port I/O string accessors actually work

    Fix port I/O string accessors such as `insb', `outsb', etc. which use
    the physical PCI port I/O address rather than the corresponding memory
    mapping to get at the requested location, which in turn breaks at least
    accesses made by our parport driver to a PCIe parallel port such as:

    PCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20
    parport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]

    causing a memory access fault:

    Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008
    Oops [#1]
    Modules linked in:
    CPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23
    Hardware name: SiFive HiFive Unmatched A00 (DT)
    epc : parport_pc_fifo_write_block_pio+0x266/0x416
     ra : parport_pc_fifo_write_block_pio+0xb4/0x416
    epc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60
     gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000
     t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0
     s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000
     a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb
     a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000
     s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50
     s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000
     s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000
     s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930
     t5 : 0000000000001000 t6 : 0000000000040000
    status: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f
    [<ffffffff80543212>] parport_pc_compat_write_block_pio+0xfe/0x200
    [<ffffffff8053bbc0>] parport_write+0x46/0xf8
    [<ffffffff8050530e>] lp_write+0x158/0x2d2
    [<ffffffff80185716>] vfs_write+0x8e/0x2c2
    [<ffffffff80185a74>] ksys_write+0x52/0xc2
    [<ffffffff80185af2>] sys_write+0xe/0x16
    [<ffffffff80003770>] ret_from_syscall+0x0/0x2
    ---[ end trace 0000000000000000 ]---

    For simplicity address the problem by adding PCI_IOBASE to the physical
    address requested in the respective wrapper macros only, observing that
    the raw accessors such as `__insb', `__outsb', etc. are not supposed to
    be used other than by said macros.  Remove the cast to `long' that is no
    longer needed on `addr' now that it is used as an offset from PCI_IOBASE
    and add parentheses around `addr' needed for predictable evaluation in
    macro expansion.  No need to make said adjustments in separate changes
    given that current code is gravely broken and does not ever work.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-013786
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?55493976");
  # https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50647-cb33@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?24f5932a");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50647");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50647");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a|20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-26', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-26', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-26', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-26', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-26', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-26', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}