Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053262)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343276);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/06");

  script_cve_id("CVE-2026-31588");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053262)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-053262 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values

    When exiting to userspace to service an emulated MMIO write, copy the
    to-be-written value to a scratch field in the MMIO fragment if the size
    of the data payload is 8 bytes or less, i.e. can fit in a single chunk,
    instead of pointing the fragment directly at the source value.

    This fixes a class of use-after-free bugs that occur when the emulator
    initiates a write using an on-stack, local variable as the source, the
    write splits a page boundary, *and* both pages are MMIO pages.  Because
    KVM's ABI only allows for physically contiguous MMIO requests, accesses
    that split MMIO pages are separated into two fragments, and are sent to
    userspace one at a time.  When KVM attempts to complete userspace MMIO in
    response to KVM_RUN after the first fragment, KVM will detect the second
    fragment and generate a second userspace exit, and reference the on-stack
    variable.

    The issue is most visible if the second KVM_RUN is performed by a separate
    task, in which case the stack of the initiating task can show up as truly
    freed data.

      ==================================================================
      BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420
      Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984

      CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org
    04/01/2014 Call Trace:
      dump_stack+0xbe/0xfd
      print_address_description.constprop.0+0x19/0x170
      __kasan_report.cold+0x6c/0x84
      kasan_report+0x3a/0x50
      check_memory_region+0xfd/0x1f0
      memcpy+0x20/0x60
      complete_emulated_mmio+0x305/0x420
      kvm_arch_vcpu_ioctl_run+0x63f/0x6d0
      kvm_vcpu_ioctl+0x413/0xb20
      __se_sys_ioctl+0x111/0x160
      do_syscall_64+0x30/0x40
      entry_SYSCALL_64_after_hwframe+0x67/0xd1
      RIP: 0033:0x42477d
      Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d
      RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
      RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c
      R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720

      The buggy address belongs to the page:
      page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37
      flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
      raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000
      raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad
    access detected

      Memory state around the buggy address:
      ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
      ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
      >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
      ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
      ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
      ==================================================================

    The bug can also be reproduced with a targeted KVM-Unit-Test by hacking
    KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by
    overwrite the data value with garbage.

    Limit the use of the scratch fields to 8-byte or smaller accesses, and to
    just writes, as larger accesses and reads are not affected thanks to
    implementation details in the emulator, but add a sanity check to ensure
    those details don't change in the future.  Specifically, KVM never uses
    on-stack variables for accesses larger that 8 bytes, e.g. uses an operand
    in the emulator context, and *al
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-053262
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cbd01929");
  # https://lore.kernel.org/linux-cve-announce/2026042414-CVE-2026-31588-333a@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4fcbb72f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-31588");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31588");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}