Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100524)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336735);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-64448");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100524)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100524 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: restrict implied bcc[0] exemption to responses without data area

    smb2_check_message() has a long-standing quirk that accepts a response
    whose calculated length is one byte larger than the bytes actually
    received (server can return one byte more due to implied bcc[0]).
    This was introduced to accommodate servers that omit the trailing bcc[0]
    overlap byte when no data area is present.

    However, the exemption is applied unconditionally, regardless of whether
    the command actually carries a data area (has_smb2_data_area[]).  When a
    response with a data area is subject to the +1 exemption, the reported
    data can extend one byte beyond the bytes actually received, yet
    smb2_check_message() still accepts it.  The subsequent decoder then reads
    past the end of the receive buffer.  This is reachable during NEGOTIATE
    and SESSION_SETUP, before the session is established.

    The resulting out-of-bounds reads are visible under KASAN when mounting
    against a non-conforming server; both the SPNEGO/negTokenInit and the
    NTLMSSP challenge decoders are affected:

      BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00
      Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81
      CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1
      Call Trace:
       <TASK>
       dump_stack_lvl+0x4e/0x70
       print_report+0x157/0x4c9
       kasan_report+0xce/0x100
       asn1_ber_decoder+0x16a7/0x1b00
       decode_negTokenInit+0x19/0x30
       SMB2_negotiate+0x31d9/0x4c90
       cifs_negotiate_protocol+0x1f2/0x3f0
       cifs_get_smb_ses+0x93f/0x17e0
       cifs_mount_get_session+0x7f/0x3a0
       cifs_mount+0xb4/0xcf0
       cifs_smb3_do_mount+0x23a/0x1500
       smb3_get_tree+0x3b0/0x630
       vfs_get_tree+0x82/0x2d0
       fc_mount+0x10/0x1b0
       path_mount+0x50d/0x1de0
       __x64_sys_mount+0x20b/0x270
       do_syscall_64+0xee/0x590
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>
      Allocated by task 85:
       kmem_cache_alloc_noprof+0x106/0x380
       mempool_alloc_noprof+0x116/0x1e0
       cifs_small_buf_get+0x31/0x80
       allocate_buffers+0x10d/0x2b0
       cifs_demultiplex_thread+0x1d5/0x1d50
       kthread+0x2c6/0x390
       ret_from_fork+0x36e/0x5a0
       ret_from_fork_asm+0x1a/0x30
      The buggy address is located 0 bytes to the right of
       allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)
       which belongs to the cache cifs_small_rq of size 448

      BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50
      Read of size 329 at addr ffff88800726c678 by task mount.cifs/89
      CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G    B      7.1.0-rc6 #1
      Call Trace:
       <TASK>
       dump_stack_lvl+0x4e/0x70
       print_report+0x157/0x4c9
       kasan_report+0xce/0x100
       kasan_check_range+0x10f/0x1e0
       __asan_memcpy+0x23/0x60
       kmemdup_noprof+0x36/0x50
       decode_ntlmssp_challenge+0x457/0x680
       SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0
       SMB2_sess_setup+0x219/0x4f0
       cifs_setup_session+0x248/0xaf0
       cifs_get_smb_ses+0xf79/0x17e0
       cifs_mount_get_session+0x7f/0x3a0
       cifs_mount+0xb4/0xcf0
       cifs_smb3_do_mount+0x23a/0x1500
       smb3_get_tree+0x3b0/0x630
       vfs_get_tree+0x82/0x2d0
       fc_mount+0x10/0x1b0
       path_mount+0x50d/0x1de0
       __x64_sys_mount+0x20b/0x270
       do_syscall_64+0xee/0x590
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>
      Allocated by task 93:
       kmem_cache_alloc_noprof+0x106/0x380
       mempool_alloc_noprof+0x116/0x1e0
       cifs_small_buf_get+0x31/0x80
       allocate_buffers+0x10d/0x2b0
       cifs_demultiplex_thread+0x1d5/0x1d50
       kthread+0x2c6/0x390
       ret_from_fork+0x36e/0x5a0
       ret_from_fork_asm+0x1a/0x30
      The buggy address is located 120 bytes inside of
       allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)
       which belongs to the cache cifs_small_rq of size 448

    Restrict the +1 exemption to responses that have no data area, so that
    it still covers the bcc[0] omission it was meant for.  When a data area
    is present, the +1 discrepancy instead means the reported data length
    overruns the
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100524
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b15f8b57");
  # https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64448-5817@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cc7b7d68");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-64448");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64448");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}