Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021564)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315908);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/20");

  script_cve_id("CVE-2022-50445");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021564)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-021564 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Reinject transport-mode packets through workqueue

    The following warning is displayed when the tcp6-multi-diffip11 stress
    test case of the LTP test suite is tested:

    watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198]
    CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39
    Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
    pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : des3_ede_encrypt+0x27c/0x460 [libdes]
    lr : 0x3f
    sp : ffff80000ceaa1b0
    x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280
    x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b
    x23: 0000000000802080 x22: 000000000000003d x21: 0000000000000038
    x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033
    x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248
    x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12: ffff80004e2d1548
    x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748
    x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b
    x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 : 000000007f1dd0a3
    x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872
    Call trace:
     des3_ede_encrypt+0x27c/0x460 [libdes]
     crypto_des3_ede_encrypt+0x1c/0x30 [des_generic]
     crypto_cbc_encrypt+0x148/0x190
     crypto_skcipher_encrypt+0x2c/0x40
     crypto_authenc_encrypt+0xc8/0xfc [authenc]
     crypto_aead_encrypt+0x2c/0x40
     echainiv_encrypt+0x144/0x1a0 [echainiv]
     crypto_aead_encrypt+0x2c/0x40
     esp6_output_tail+0x1c8/0x5d0 [esp6]
     esp6_output+0x120/0x278 [esp6]
     xfrm_output_one+0x458/0x4ec
     xfrm_output_resume+0x6c/0x1f0
     xfrm_output+0xac/0x4ac
     __xfrm6_output+0x130/0x270
     xfrm6_output+0x60/0xec
     ip6_xmit+0x2ec/0x5bc
     inet6_csk_xmit+0xbc/0x10c
     __tcp_transmit_skb+0x460/0x8c0
     tcp_write_xmit+0x348/0x890
     __tcp_push_pending_frames+0x44/0x110
     tcp_rcv_established+0x3c8/0x720
     tcp_v6_do_rcv+0xdc/0x4a0
     tcp_v6_rcv+0xc24/0xcb0
     ip6_protocol_deliver_rcu+0xf0/0x574
     ip6_input_finish+0x48/0x7c
     ip6_input+0x48/0xc0
     ip6_rcv_finish+0x80/0x9c
     xfrm_trans_reinject+0xb0/0xf4
     tasklet_action_common.constprop.0+0xf8/0x134
     tasklet_action+0x30/0x3c
     __do_softirq+0x128/0x368
     do_softirq+0xb4/0xc0
     __local_bh_enable_ip+0xb0/0xb4
     put_cpu_fpsimd_context+0x40/0x70
     kernel_neon_end+0x20/0x40
     sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce]
     sha1_ce_finup+0x94/0x110 [sha1_ce]
     crypto_shash_finup+0x34/0xc0
     hmac_finup+0x48/0xe0
     crypto_shash_finup+0x34/0xc0
     shash_digest_unaligned+0x74/0x90
     crypto_shash_digest+0x4c/0x9c
     shash_ahash_digest+0xc8/0xf0
     shash_async_digest+0x28/0x34
     crypto_ahash_digest+0x48/0xcc
     crypto_authenc_genicv+0x88/0xcc [authenc]
     crypto_authenc_encrypt+0xd8/0xfc [authenc]
     crypto_aead_encrypt+0x2c/0x40
     echainiv_encrypt+0x144/0x1a0 [echainiv]
     crypto_aead_encrypt+0x2c/0x40
     esp6_output_tail+0x1c8/0x5d0 [esp6]
     esp6_output+0x120/0x278 [esp6]
     xfrm_output_one+0x458/0x4ec
     xfrm_output_resume+0x6c/0x1f0
     xfrm_output+0xac/0x4ac
     __xfrm6_output+0x130/0x270
     xfrm6_output+0x60/0xec
     ip6_xmit+0x2ec/0x5bc
     inet6_csk_xmit+0xbc/0x10c
     __tcp_transmit_skb+0x460/0x8c0
     tcp_write_xmit+0x348/0x890
     __tcp_push_pending_frames+0x44/0x110
     tcp_push+0xb4/0x14c
     tcp_sendmsg_locked+0x71c/0xb64
     tcp_sendmsg+0x40/0x6c
     inet6_sendmsg+0x4c/0x80
     sock_sendmsg+0x5c/0x6c
     __sys_sendto+0x128/0x15c
     __arm64_sys_sendto+0x30/0x40
     invoke_syscall+0x50/0x120
     el0_svc_common.constprop.0+0x170/0x194
     do_el0_svc+0x38/0x4c
     el0_svc+0x28/0xe0
     el0t_64_sync_handler+0xbc/0x13c
     el0t_64_sync+0x180/0x184

    Get softirq info by bcc tool:
    ./softirqs -NT 10
    Tracing soft irq event time... Hit Ctrl-C to end.

    15:34:34
    SOFTIRQ          TOTAL_nsecs
    block                 158990
    timer               20030920
    sched               46577080
    net_rx             676746820
    tasklet           9906067650

    15:34:45
    SOFTIRQ          TOTAL_nsecs
    block                  86100
    sched               38849790
    net_rx
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-021564
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?027b6409");
  # https://lore.kernel.org/linux-cve-announce/2025100115-CVE-2022-50445-5873@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7953ba54");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50445");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50445");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}