Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100570)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336919);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-64114");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100570)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100570 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: raw: reject IP_HDRINCL packets with ihl < 5

    raw_send_hdrinc() validates that the caller-supplied IPv4 header
    fits within the message length:

        iphlen = iph->ihl * 4;
        err = -EINVAL;
        if (iphlen > length)
            goto error_free;

        if (iphlen >= sizeof(*iph)) {
            /* fix up saddr, tot_len, id, csum, transport_header */
        }

    It does not, however, reject ihl < 5.  For such a packet the
    if (iphlen >= sizeof(*iph)) branch is skipped, leaving the
    crafted iphdr untouched, but the packet is still handed to
    __ip_local_out() and onward.  Downstream consumers that read
    iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in
    particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
    and passes the (signed-int-negative, then cast to size_t)
    result to memcpy(), producing an OOB access of length close to
    SIZE_MAX and a host kernel panic.

    An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
    Internet Header Length is the length of the internet header in
    32 bit words ... Note that the minimum value for a correct header
    is 5.).  The kernel should not be willing to inject such a
    packet into its own output path.

    Reject iphlen < sizeof(*iph) alongside the existing
    iphlen > length check.  This matches the principle that locally
    constructed packets that re-enter the IP stack must pass the same
    basic sanity tests that a foreign packet would be subjected to.

    Once this lands, the if (iphlen >= sizeof(*iph)) wrapper around
    the fixup branch becomes redundant; left in place to keep the
    patch minimal and backport-friendly.  A follow-up can unwrap it.

    Note that commit 86f4c90a1c5c (ipv4, ipv6: ensure raw socket
    message is big enough to hold an IP header) ensures the message
    buffer is large enough to hold an iphdr, but does not constrain
    the self-reported iph->ihl.

    Reachability: the malformed packet source is any caller with
    CAP_NET_RAW, including an unprivileged process in a user+net
    namespace on a kernel with CONFIG_USER_NS=y.  The reproduced AH
    crash also requires a matching xfrm AH policy on the outgoing
    route; a container granted CAP_NET_ADMIN can install that state
    and policy in its netns.  Loopback bypasses xfrm_output, so the
    trigger uses a real netdev.

    Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
    memcpy_orig at the crash site.  Same shape reproduces inside a
    rootless Docker container with --cap-add NET_ADMIN on a stock
    distro kernel.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100570
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fe2b51aa");
  # https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64114-d584@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?529f6886");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-64114");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64114");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}