Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053366)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343145);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/06");

  script_cve_id("CVE-2026-31607");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053366)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-053366 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit()

    When a USB/IP client receives a RET_SUBMIT response,
    usbip_pack_ret_submit() unconditionally overwrites
    urb->number_of_packets from the network PDU. This value is
    subsequently used as the loop bound in usbip_recv_iso() and
    usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible
    array whose size was fixed at URB allocation time based on the
    *original* number_of_packets from the CMD_SUBMIT.

    A malicious USB/IP server can set number_of_packets in the response
    to a value larger than what was originally submitted, causing a heap
    out-of-bounds write when usbip_recv_iso() writes to
    urb->iso_frame_desc[i] beyond the allocated region.

    KASAN confirmed this with kernel 7.0.0-rc5:

      BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640
      Write of size 4 at addr ffff888106351d40 by task vhci_rx/69

      The buggy address is located 0 bytes to the right of
       allocated 320-byte region [ffff888106351c00, ffff888106351d40)

    The server side (stub_rx.c) and gadget side (vudc_rx.c) already
    validate number_of_packets in the CMD_SUBMIT path since commits
    c6688ef9f297 (usbip: fix stub_rx: harden CMD_SUBMIT path to handle
    malicious input) and b78d830f0049 (usbip: fix vudc_rx: harden
    CMD_SUBMIT path to handle malicious input). The server side validates
    against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.
    On the client side we have the original URB, so we can use the tighter
    bound: the response must not exceed the original number_of_packets.

    This mirrors the existing validation of actual_length against
    transfer_buffer_length in usbip_recv_xbuff(), which checks the
    response value against the original allocation size.

    Kelvin Mbogo's series (usb: usbip: fix integer overflow in
    usbip_recv_iso(), v2) hardens the receive-side functions themselves;
    this patch complements that work by catching the bad value at its
    source -- in usbip_pack_ret_submit() before the overwrite -- and
    using the tighter per-URB allocation bound rather than the global
    USBIP_MAX_ISO_PACKETS limit.

    Fix this by checking rpdu->number_of_packets against
    urb->number_of_packets in usbip_pack_ret_submit() before the
    overwrite. On violation, clamp to zero so that usbip_recv_iso() and
    usbip_pad_iso() safely return early.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-053366
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c0cf2ee");
  # https://lore.kernel.org/linux-cve-announce/2026042420-CVE-2026-31607-7bac@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dcdd8de4");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-31607");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31607");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}