Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100295)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336300);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2025-38488");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100295)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100295 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free in crypt_message when using async crypto

    The CVE-2024-50047 fix removed asynchronous crypto handling from
    crypt_message(), assuming all crypto operations are synchronous.
    However, when hardware crypto accelerators are used, this can cause
    use-after-free crashes:

      crypt_message()
        // Allocate the creq buffer containing the req
        creq = smb2_get_aead_req(..., &req);

        // Async encryption returns -EINPROGRESS immediately
        rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);

        // Free creq while async operation is still in progress
        kvfree_sensitive(creq, ...);

    Hardware crypto modules often implement async AEAD operations for
    performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,
    the operation completes asynchronously. Without crypto_wait_req(),
    the function immediately frees the request buffer, leading to crashes
    when the driver later accesses the freed memory.

    This results in a use-after-free condition when the hardware crypto
    driver later accesses the freed request structure, leading to kernel
    crashes with NULL pointer dereferences.

    The issue occurs because crypto_alloc_aead() with mask=0 doesn't
    guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in
    the mask, async implementations can be selected.

    Fix by restoring the async crypto handling:
    - DECLARE_CRYPTO_WAIT(wait) for completion tracking
    - aead_request_set_callback() for async completion notification
    - crypto_wait_req() to wait for operation completion

    This ensures the request buffer isn't freed until the crypto operation
    completes, whether synchronous or asynchronous, while preserving the
    CVE-2024-50047 fix.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100295
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bb3e71f7");
  # https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b17f882b");
  # https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?94870119");
  # https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9f74aeee");
  # https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3868946");
  # https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3d1c344b");
  # https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cd86b582");
  # https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7564e0e");
  # https://lore.kernel.org/linux-cve-announce/2025072816-CVE-2025-38488-7f36@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8f61852");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38488");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-38488");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38488");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}