Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102097)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338538);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-45842");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102097)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102097 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    slip: reject VJ receive packets on instances with no rstate array

    slhc_init() accepts rslots == 0 as a valid configuration, with the
    documented meaning of 'no receive compression'. In that case the
    allocation loop in slhc_init() is skipped, so comp->rstate stays
    NULL and comp->rslot_limit stays 0 (from the kzalloc of struct
    slcompress).

    The receive helpers do not defend against that configuration.
    slhc_uncompress() dereferences comp->rstate[x] when the VJ header
    carries an explicit connection ID, and slhc_remember() later assigns
    cs = &comp->rstate[...] after only comparing the packet's slot number
    to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the
    range check, and the code dereferences a NULL rstate.

    The configuration is reachable in-tree through PPP. PPPIOCSMAXCID
    stores its argument in a signed int, and (val >> 16) uses arithmetic
    shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1
    is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because
    /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path
    is reachable from an unprivileged user namespace. Once the malformed
    VJ state is installed, any inbound VJ-compressed or VJ-uncompressed
    frame that selects slot 0 crashes the kernel in softirq context:

     Oops: general protection fault, probably for non-canonical
           address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
     KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
     RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
     Call Trace:
      <TASK>
      ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
      ppp_input (drivers/net/ppp/ppp_generic.c:2359)
      ppp_async_process (drivers/net/ppp/ppp_async.c:492)
      tasklet_action_common (kernel/softirq.c:926)
      handle_softirqs (kernel/softirq.c:623)
      run_ksoftirqd (kernel/softirq.c:1055)
      smpboot_thread_fn (kernel/smpboot.c:160)
      kthread (kernel/kthread.c:436)
      ret_from_fork (arch/x86/kernel/process.c:164)
      </TASK>

    Reject the receive side on such instances instead of touching rstate.
    slhc_uncompress() falls through to its existing 'bad' label, which
    bumps sls_i_error and enters the toss state. slhc_remember() mirrors
    that with an explicit sls_i_error increment followed by slhc_toss();
    the sls_i_runt counter is not used here because a missing rstate is
    an internal configuration state, not a runt packet.

    The transmit path is unaffected: the only in-tree caller that picks
    rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and
    slip.c always calls slhc_init(16, 16), so comp->tstate remains valid
    and slhc_compress() continues to work.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102097
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?19e415eb");
  # https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45842-71fc@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c39e3d07");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-45842");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45842");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}