Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098674)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340477);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2024-57979");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098674)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098674 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    pps: Fix a use-after-free

    On a board running ntpd and gpsd, I'm seeing a consistent use-after-free
    in sys_exit() from gpsd when rebooting:

        pps pps1: removed
        ------------[ cut here ]------------
        kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
        WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
        CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
        Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
        pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
        pc : kobject_put+0x120/0x150
        lr : kobject_put+0x120/0x150
        sp : ffffffc0803d3ae0
        x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
        x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
        x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
        x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
        x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
        x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
        x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
        x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
        x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
        x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
        Call trace:
         kobject_put+0x120/0x150
         cdev_put+0x20/0x3c
         __fput+0x2c4/0x2d8
         ____fput+0x1c/0x38
         task_work_run+0x70/0xfc
         do_exit+0x2a0/0x924
         do_group_exit+0x34/0x90
         get_signal+0x7fc/0x8c0
         do_signal+0x128/0x13b4
         do_notify_resume+0xdc/0x160
         el0_svc+0xd4/0xf8
         el0t_64_sync_handler+0x140/0x14c
         el0t_64_sync+0x190/0x194
        ---[ end trace 0000000000000000 ]---

    ...followed by more symptoms of corruption, with similar stacks:

        refcount_t: underflow; use-after-free.
        kernel BUG at lib/list_debug.c:62!
        Kernel panic - not syncing: Oops - BUG: Fatal exception

    This happens because pps_device_destruct() frees the pps_device with the
    embedded cdev immediately after calling cdev_del(), but, as the comment
    above cdev_del() notes, fops for previously opened cdevs are still
    callable even after cdev_del() returns. I think this bug has always
    been there: I can't explain why it suddenly started happening every time
    I reboot this particular board.

    In commit d953e0e837e6 (pps: Fix a use-after free bug when
    unregistering a source.), George Spelvin suggested removing the
    embedded cdev. That seems like the simplest way to fix this, so I've
    implemented his suggestion, using __register_chrdev() with pps_idr
    becoming the source of truth for which minor corresponds to which
    device.

    But now that pps_idr defines userspace visibility instead of cdev_add(),
    we need to be sure the pps->dev refcount can't reach zero while
    userspace can still find it again. So, the idr_remove() call moves to
    pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.

        pps_core: source serial1 got cdev (251:1)
        <...>
        pps pps1: removed
        pps_core: unregistering pps1
        pps_core: deallocating pps1

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098674
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4ec1ff3e");
  # https://lore.kernel.org/linux-cve-announce/2025022634-CVE-2024-57979-aad0@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b59734f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-57979");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-57979");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}