Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-085343)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343293);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/06");

  script_cve_id("CVE-2022-50401");

  script_name(english:"Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-085343)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-085343 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure

    On error situation `clp->cl_cb_conn.cb_xprt` should not be given
    a reference to the xprt otherwise both client cleanup and the
    error handling path of the caller call to put it. Better to
    delay handing over the reference to a later branch.

    [   72.530665] refcount_t: underflow; use-after-free.
    [   72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120
    [   72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE)
    nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm
    ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE
    nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet
    nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6
    nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs
    serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc]
    [   72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G           OE     5.15.82-dan #1
    [   72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014
    [   72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd]
    [   72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120
    [   72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1
    60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff
    48
    [   72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286
    [   72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000
    [   72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0
    [   72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff
    [   72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180
    [   72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0
    [   72.552089] FS:  0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000
    [   72.553175] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0
    [   72.554874] Call Trace:
    [   72.555278]  <TASK>
    [   72.555614]  svc_xprt_put+0xaf/0xe0 [sunrpc]
    [   72.556276]  nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd]
    [   72.557087]  ? update_load_avg+0x82/0x610
    [   72.557652]  ? cpuacct_charge+0x60/0x70
    [   72.558212]  ? dequeue_entity+0xdb/0x3e0
    [   72.558765]  ? queued_spin_unlock+0x9/0x20
    [   72.559358]  nfsd4_run_cb_work+0xfc/0x270 [nfsd]
    [   72.560031]  process_one_work+0x1df/0x390
    [   72.560600]  worker_thread+0x37/0x3b0
    [   72.561644]  ? process_one_work+0x390/0x390
    [   72.562247]  kthread+0x12f/0x150
    [   72.562710]  ? set_kthread_struct+0x50/0x50
    [   72.563309]  ret_from_fork+0x22/0x30
    [   72.563818]  </TASK>
    [   72.564189] ---[ end trace 031117b1c72ec616 ]---
    [   72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was
    ffff89ac4763e018. (next=ffff89ac4763e018).
    [   72.567647] ------------[ cut here ]------------

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-085343
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fd5758d3");
  # https://git.kernel.org/stable/c/15fc60aa5bdcf6d5f93000d3d00579fc67632ee0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?165e512b");
  # https://git.kernel.org/stable/c/3bc8edc98bd43540dbe648e4ef91f443d6d20a24
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?70859217");
  # https://git.kernel.org/stable/c/707bcca9616002d204091ca7c4d1d91151104332
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4645461a");
  # https://git.kernel.org/stable/c/9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7268245e");
  # https://git.kernel.org/stable/c/a472f069ced8601979f53c13c0cf20236074ed46
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa463c12");
  # https://git.kernel.org/stable/c/c1207219a4bfa50121c9345d5d165470d0a82531
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93c30042");
  # https://git.kernel.org/stable/c/d843ebd860c58a38e45527e8ec6516059f4c97f3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?536b78f6");
  # https://git.kernel.org/stable/c/e2f9f03e4537f3fcc8fd2bdd3248530c3477a371
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a5885203");
  # https://git.kernel.org/stable/c/fddac3b4578d302ac9e51e7f03a9aae6254ae2a3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdda6222");
  # https://lore.kernel.org/linux-cve-announce/2025091850-CVE-2022-50401-814e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59b87723");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2022-50401");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-50401");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-50401");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e|20.1060e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.47.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.47.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.104.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.104.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.104.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}