Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021637)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315813);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/20");

  script_cve_id("CVE-2024-57884");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021637)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-021637 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()

    The task sometimes continues looping in throttle_direct_reclaim() because
    allow_direct_reclaim(pgdat) keeps returning false.

     #0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac
     #1 [ffff80002cb6f900] __schedule at ffff800008abbd1c
     #2 [ffff80002cb6f990] schedule at ffff800008abc50c
     #3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550
     #4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68
     #5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660
     #6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98
     #7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8
     #8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974
     #9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4

    At this point, the pgdat contains the following two zones:

            NODE: 4  ZONE: 0  ADDR: ffff00817fffe540  NAME: DMA32
              SIZE: 20480  MIN/LOW/HIGH: 11/28/45
              VM_STAT:
                    NR_FREE_PAGES: 359
            NR_ZONE_INACTIVE_ANON: 18813
              NR_ZONE_ACTIVE_ANON: 0
            NR_ZONE_INACTIVE_FILE: 50
              NR_ZONE_ACTIVE_FILE: 0
              NR_ZONE_UNEVICTABLE: 0
            NR_ZONE_WRITE_PENDING: 0
                         NR_MLOCK: 0
                        NR_BOUNCE: 0
                       NR_ZSPAGES: 0
                NR_FREE_CMA_PAGES: 0

            NODE: 4  ZONE: 1  ADDR: ffff00817fffec00  NAME: Normal
              SIZE: 8454144  PRESENT: 98304  MIN/LOW/HIGH: 68/166/264
              VM_STAT:
                    NR_FREE_PAGES: 146
            NR_ZONE_INACTIVE_ANON: 94668
              NR_ZONE_ACTIVE_ANON: 3
            NR_ZONE_INACTIVE_FILE: 735
              NR_ZONE_ACTIVE_FILE: 78
              NR_ZONE_UNEVICTABLE: 0
            NR_ZONE_WRITE_PENDING: 0
                         NR_MLOCK: 0
                        NR_BOUNCE: 0
                       NR_ZSPAGES: 0
                NR_FREE_CMA_PAGES: 0

    In allow_direct_reclaim(), while processing ZONE_DMA32, the sum of
    inactive/active file-backed pages calculated in zone_reclaimable_pages()
    based on the result of zone_page_state_snapshot() is zero.

    Additionally, since this system lacks swap, the calculation of inactive/
    active anonymous pages is skipped.

            crash> p nr_swap_pages
            nr_swap_pages = $1937 = {
              counter = 0
            }

    As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to
    the processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having
    free pages significantly exceeding the high watermark.

    The problem is that the pgdat->kswapd_failures hasn't been incremented.

            crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures
            $1935 = 0x0

    This is because the node deemed balanced.  The node balancing logic in
    balance_pgdat() evaluates all zones collectively.  If one or more zones
    (e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the
    entire node is deemed balanced.  This causes balance_pgdat() to exit early
    before incrementing the kswapd_failures, as it considers the overall
    memory state acceptable, even though some zones (like ZONE_NORMAL) remain
    under significant pressure.


    The patch ensures that zone_reclaimable_pages() includes free pages
    (NR_FREE_PAGES) in its calculation when no other reclaimable pages are
    available (e.g., file-backed or anonymous pages).  This change prevents
    zones like ZONE_DMA32, which have sufficient free pages, from being
    mistakenly deemed unreclaimable.  By doing so, the patch ensures proper
    node balancing, avoids masking pressure on other zones like ZONE_NORMAL,
    and prevents infinite loops in throttle_direct_reclaim() caused by
    allow_direct_reclaim(pgdat) repeatedly returning false.


    The kernel hangs due to a task stuck in throttle_direct_reclaim(), caused
    by a node being incorrectly deemed balanced despite pressure in certain
    zones, such as ZONE_NORMAL.  This issue arises from
    zone_reclaimable_pages
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-021637
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?695bada5");
  # https://lore.kernel.org/linux-cve-announce/2025011510-CVE-2024-57884-4cf8@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b994038f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-57884");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-57884");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.56.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}