Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107328)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344934);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2024-57979");

  script_name(english:"Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107328)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-107328 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    pps: Fix a use-after-free

    On a board running ntpd and gpsd, I'm seeing a consistent use-after-free
    in sys_exit() from gpsd when rebooting:

        pps pps1: removed
        ------------[ cut here ]------------
        kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
        WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
        CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
        Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
        pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
        pc : kobject_put+0x120/0x150
        lr : kobject_put+0x120/0x150
        sp : ffffffc0803d3ae0
        x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
        x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
        x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
        x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
        x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
        x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
        x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
        x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
        x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
        x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
        Call trace:
         kobject_put+0x120/0x150
         cdev_put+0x20/0x3c
         __fput+0x2c4/0x2d8
         ____fput+0x1c/0x38
         task_work_run+0x70/0xfc
         do_exit+0x2a0/0x924
         do_group_exit+0x34/0x90
         get_signal+0x7fc/0x8c0
         do_signal+0x128/0x13b4
         do_notify_resume+0xdc/0x160
         el0_svc+0xd4/0xf8
         el0t_64_sync_handler+0x140/0x14c
         el0t_64_sync+0x190/0x194
        ---[ end trace 0000000000000000 ]---

    ...followed by more symptoms of corruption, with similar stacks:

        refcount_t: underflow; use-after-free.
        kernel BUG at lib/list_debug.c:62!
        Kernel panic - not syncing: Oops - BUG: Fatal exception

    This happens because pps_device_destruct() frees the pps_device with the
    embedded cdev immediately after calling cdev_del(), but, as the comment
    above cdev_del() notes, fops for previously opened cdevs are still
    callable even after cdev_del() returns. I think this bug has always
    been there: I can't explain why it suddenly started happening every time
    I reboot this particular board.

    In commit d953e0e837e6 (pps: Fix a use-after free bug when
    unregistering a source.), George Spelvin suggested removing the
    embedded cdev. That seems like the simplest way to fix this, so I've
    implemented his suggestion, using __register_chrdev() with pps_idr
    becoming the source of truth for which minor corresponds to which
    device.

    But now that pps_idr defines userspace visibility instead of cdev_add(),
    we need to be sure the pps->dev refcount can't reach zero while
    userspace can still find it again. So, the idr_remove() call moves to
    pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.

        pps_core: source serial1 got cdev (251:1)
        <...>
        pps pps1: removed
        pps_core: unregistering pps1
        pps_core: deallocating pps1

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-107328
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0fb975d");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-019113.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  # https://git.kernel.org/stable/c/1a7735ab2cb9747518a7416fb5929e85442dec62
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0340b990");
  # https://git.kernel.org/stable/c/785c78ed0d39d1717cca3ef931d3e51337b5e90e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?583e9895");
  # https://git.kernel.org/stable/c/7e5ee3281dc09014367f5112b6d566ba36ea2d49
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?10621073");
  # https://git.kernel.org/stable/c/85241f7de216f8298f6e48540ea13d7dcd100870
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aceefa8b");
  # https://git.kernel.org/stable/c/91932db1d96b2952299ce30c1c693d834d10ace6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8648f020");
  # https://git.kernel.org/stable/c/c4041b6b0a7a3def8cf3f3d6120ff337bc4c40f7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?84ef987a");
  # https://git.kernel.org/stable/c/c79a39dc8d060b9e64e8b0fa9d245d44befeefbe
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9687c9a4");
  # https://git.kernel.org/stable/c/cd3bbcb6b3a7caa5ce67de76723b6d8531fb7f64
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f00670ab");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html");
  # https://lore.kernel.org/linux-cve-announce/2025022634-CVE-2024-57979-aad0@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b59734f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-57979");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2024-57979");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-57979");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e|20.1060e|20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}