Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100520)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336837);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-64450");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100520)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100520 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix out-of-bounds read in broadcast Gap ACK blocks

    A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its
    data area. tipc_get_gap_ack_blks() only verifies that the record's len
    field is self-consistent with its ugack_cnt/bgack_cnt counts
    (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check
    that the record actually fits in the message data area, msg_data_sz().

    The unicast caller tipc_link_proto_rcv() bounds it (if (glen > dlen)
    break;), but the broadcast caller tipc_bcast_sync_rcv() discards the
    returned size, so tipc_link_advance_transmq() copies the record off the
    receive skb with an attacker-controlled count:

            this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),
                              GFP_ATOMIC);

    A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one
    ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its
    data area is short, carrying a Gap ACK record with len = 0x400,
    bgack_cnt = 0xff and ugack_cnt = 0. len then equals
    struct_size(p, gacks, 255), so the consistency check passes and ga is
    non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out
    of the much smaller skb:

      BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60
      Read of size 1024 at addr ffff0000c7030d38 by task poc864/69
      Call trace:
       kmemdup_noprof+0x48/0x60
       tipc_link_advance_transmq+0x86c/0xb80
       tipc_link_bc_ack_rcv+0x19c/0x1e0
       tipc_bcast_sync_rcv+0x1c4/0x2c4
       tipc_rcv+0x85c/0x1340
       tipc_l2_rcv_msg+0xac/0x104
      The buggy address belongs to the object at ffff0000c7030d00
       which belongs to the cache skbuff_small_head of size 704
      The buggy address is located 56 bytes inside of
       allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)

    The copied-out bytes are subsequently consumed as gap/ack values, but
    the read is already out of bounds at the kmemdup() regardless of how
    they are used.

    The unicast STATE path drops such a message: if (glen > dlen) break;
    skips the rest of STATE_MSG handling and the skb is freed. Make the
    broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record
    against msg_data_sz() and, when it does not fit, reports it back through
    tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than
    processed. ga is not cleared on this path: ga == NULL already means
    legacy peer without Selective ACK, a distinct legitimate state.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100520
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13dec0f5");
  # https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64450-b0e5@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ab4445f8");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-64450");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64450");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}