Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098911)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340184);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2026-64320");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098911)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098911 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

    nvmet_execute_disc_get_log_page() validates only the dword alignment
    of the host-supplied Log Page Offset (lpo).  The 64-bit offset is then
    added to a small kzalloc'd buffer that holds the discovery log page
    and the result is passed straight to nvmet_copy_to_sgl(), which
    memcpy()s data_len bytes out to the host with no source-side bound
    check:

        u64 offset      = nvmet_get_log_page_offset(req->cmd);  /* 64-bit host */
        size_t data_len = nvmet_get_log_page_len(req->cmd);     /* 32-bit host */
        ...
        if (offset & 0x3) { ... }                               /* only check */
        ...
        alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);
        buffer = kzalloc(alloc_len, GFP_KERNEL);
        ...
        status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);

    The Discovery controller is unauthenticated -- nvmet_host_allowed()
    returns true unconditionally for the discovery subsystem -- so the call
    is reachable pre-authentication by any TCP/RDMA/FC peer that can reach
    the nvmet target.  With a discovery log page of ~1 KiB, an attacker
    requesting up to 4 KiB starting at offset == alloc_len reads the next
    slab page out and gets its content returned over the fabric (an
    empirical run on a default nvmet-tcp loopback target leaked 81
    canonical kernel pointers in one Get Log Page response).  Pointing the
    offset at unmapped kernel memory faults the in-kernel memcpy and
    crashes (or panics, on panic_on_oops=1) the target host instead.

    The attacker-controlled source-side offset pattern
    nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...) is unique
    to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every
    other Get Log Page handler in admin-cmd.c either ignores lpo (and
    silently starts every response at offset 0) or tracks a local
    destination offset with a fixed source pointer.

    Validate the host-supplied offset against the log page size, cap the
    copy length to what is actually available, and zero-fill any remainder
    of the host transfer buffer.  The zero-fill matches the existing
    short-response pattern in nvmet_execute_get_log_changed_ns()
    (admin-cmd.c) and prevents leaking transport SGL contents when the
    host asks for more bytes than the log page contains.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098911
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0e7d38b3");
  # https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64320-4b43@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?134ed93e");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-64320");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64320");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}