Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021615)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315816);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/20");

  script_cve_id("CVE-2024-53058");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021615)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-021615 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data

    In case the non-paged data of a SKB carries protocol header and protocol
    payload to be transmitted on a certain platform that the DMA AXI address
    width is configured to 40-bit/48-bit, or the size of the non-paged data
    is bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI
    address width is configured to 32-bit, then this SKB requires at least
    two DMA transmit descriptors to serve it.

    For example, three descriptors are allocated to split one DMA buffer
    mapped from one piece of non-paged data:
        dma_desc[N + 0],
        dma_desc[N + 1],
        dma_desc[N + 2].
    Then three elements of tx_q->tx_skbuff_dma[] will be allocated to hold
    extra information to be reused in stmmac_tx_clean():
        tx_q->tx_skbuff_dma[N + 0],
        tx_q->tx_skbuff_dma[N + 1],
        tx_q->tx_skbuff_dma[N + 2].
    Now we focus on tx_q->tx_skbuff_dma[entry].buf, which is the DMA buffer
    address returned by DMA mapping call. stmmac_tx_clean() will try to
    unmap the DMA buffer _ONLY_IF_ tx_q->tx_skbuff_dma[entry].buf
    is a valid buffer address.

    The expected behavior that saves DMA buffer address of this non-paged
    data to tx_q->tx_skbuff_dma[entry].buf is:
        tx_q->tx_skbuff_dma[N + 0].buf = NULL;
        tx_q->tx_skbuff_dma[N + 1].buf = NULL;
        tx_q->tx_skbuff_dma[N + 2].buf = dma_map_single();
    Unfortunately, the current code misbehaves like this:
        tx_q->tx_skbuff_dma[N + 0].buf = dma_map_single();
        tx_q->tx_skbuff_dma[N + 1].buf = NULL;
        tx_q->tx_skbuff_dma[N + 2].buf = NULL;

    On the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the
    DMA engine, tx_q->tx_skbuff_dma[N + 0].buf is a valid buffer address
    obviously, then the DMA buffer will be unmapped immediately.
    There may be a rare case that the DMA engine does not finish the
    pending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go
    horribly wrong, DMA is going to access a unmapped/unreferenced memory
    region, corrupted data will be transmited or iommu fault will be
    triggered :(

    In contrast, the for-loop that maps SKB fragments behaves perfectly
    as expected, and that is how the driver should do for both non-paged
    data and paged frags actually.

    This patch corrects DMA map/unmap sequences by fixing the array index
    for tx_q->tx_skbuff_dma[entry].buf when assigning DMA buffer address.

    Tested and verified on DWXGMAC CORE 3.20a

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-021615
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?924980fc");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-53058");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-53058");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}