Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014336)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(310355);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/26");

  script_cve_id("CVE-2025-39988");

  script_name(english:"Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014336)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-014336 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow

    Sending an PF_PACKET allows to bypass the CAN framework logic and to
    directly reach the xmit() function of a CAN driver. The only check
    which is performed by the PF_PACKET framework is to make sure that
    skb->len fits the interface's MTU.

    Unfortunately, because the etas_es58x driver does not populate its
    net_device_ops->ndo_change_mtu(), it is possible for an attacker to
    configure an invalid MTU by doing, for example:

      $ ip link set can0 mtu 9999

    After doing so, the attacker could open a PF_PACKET socket using the
    ETH_P_CANXL protocol:

            socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));

    to inject a malicious CAN XL frames. For example:

            struct canxl_frame frame = {
                    .flags = 0xff,
                    .len = 2048,
            };

    The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
    check that the skb is valid, unfortunately under above conditions, the
    malicious packet is able to go through can_dev_dropped_skb() checks:

      1. the skb->protocol is set to ETH_P_CANXL which is valid (the
         function does not check the actual device capabilities).

      2. the length is a valid CAN XL length.

    And so, es58x_start_xmit() receives a CAN XL frame which it is not
    able to correctly handle and will thus misinterpret it as a CAN(FD)
    frame.

    This can result in a buffer overflow. For example, using the es581.4
    variant, the frame will be dispatched to es581_4_tx_can_msg(), go
    through the last check at the beginning of this function:

            if (can_is_canfd_skb(skb))
                    return -EMSGSIZE;

    and reach this line:

            memcpy(tx_can_msg->data, cf->data, cf->len);

    Here, cf->len corresponds to the flags field of the CAN XL frame. In
    our previous example, we set canxl_frame->flags to 0xff. Because the
    maximum expected length is 8, a buffer overflow of 247 bytes occurs!

    Populate net_device_ops->ndo_change_mtu() to ensure that the
    interface's MTU can not be set to anything bigger than CAN_MTU or
    CANFD_MTU (depending on the device capabilities). By fixing the root
    cause, this prevents the buffer overflow.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-014336
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2317faf2");
  # https://lore.kernel.org/linux-cve-announce/2025101501-CVE-2025-39988-bda0@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?10c21818");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-39988");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39988");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1060a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1060a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-46.38', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}