Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131759)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366578);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id("CVE-2026-43161");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131759)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-131759 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

    PCIe endpoints with ATS enabled and passed through to userspace
    (e.g., QEMU, DPDK) can hard-lock the host when their link drops,
    either by surprise removal or by a link fault.

    Commit 4fc82cd907ac (iommu/vt-d: Don't issue ATS Invalidation
    request when device is disconnected) adds pci_dev_is_disconnected()
    to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
    only when the device is being safely removed, but it applies only
    when Intel IOMMU scalable mode is enabled.

    With scalable mode disabled or unsupported, a system hard-lock
    occurs when a PCIe endpoint's link drops because the Intel IOMMU
    waits indefinitely for an ATS invalidation that cannot complete.

    Call Trace:
     qi_submit_sync
     qi_flush_dev_iotlb
     __context_flush_dev_iotlb.part.0
     domain_context_clear_one_cb
     pci_for_each_dma_alias
     device_block_translation
     blocking_domain_attach_dev
     iommu_deinit_device
     __iommu_group_remove_device
     iommu_release_device
     iommu_bus_notifier
     blocking_notifier_call_chain
     bus_notify
     device_del
     pci_remove_bus_device
     pci_stop_and_remove_bus_device
     pciehp_unconfigure_device
     pciehp_disable_slot
     pciehp_handle_presence_or_link_change
     pciehp_ist

    Commit 81e921fd3216 (iommu/vt-d: Fix NULL domain on device release)
    adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
    which calls qi_flush_dev_iotlb() and can also hard-lock the system
    when a PCIe endpoint's link drops.

    Call Trace:
     qi_submit_sync
     qi_flush_dev_iotlb
     __context_flush_dev_iotlb.part.0
     intel_context_flush_no_pasid
     device_pasid_table_teardown
     pci_pasid_table_teardown
     pci_for_each_dma_alias
     intel_pasid_teardown_sm_context
     intel_iommu_release_device
     iommu_deinit_device
     __iommu_group_remove_device
     iommu_release_device
     iommu_bus_notifier
     blocking_notifier_call_chain
     bus_notify
     device_del
     pci_remove_bus_device
     pci_stop_and_remove_bus_device
     pciehp_unconfigure_device
     pciehp_disable_slot
     pciehp_handle_presence_or_link_change
     pciehp_ist

    Sometimes the endpoint loses connection without a link-down event
    (e.g., due to a link fault); killing the process (virsh destroy)
    then hard-locks the host.

    Call Trace:
     qi_submit_sync
     qi_flush_dev_iotlb
     __context_flush_dev_iotlb.part.0
     domain_context_clear_one_cb
     pci_for_each_dma_alias
     device_block_translation
     blocking_domain_attach_dev
     __iommu_attach_device
     __iommu_device_set_domain
     __iommu_group_set_domain_internal
     iommu_detach_group
     vfio_iommu_type1_detach_group
     vfio_group_detach_container
     vfio_group_fops_release
     __fput

    pci_dev_is_disconnected() only covers safe-removal paths;
    pci_device_is_present() tests accessibility by reading
    vendor/device IDs and internally calls pci_dev_is_disconnected().
    On a ConnectX-5 (8 GT/s, x2) this costs ~70 s.

    Since __context_flush_dev_iotlb() is only called on
    {attach,release}_dev paths (not hot), add pci_device_is_present()
    there to skip inaccessible devices and avoid the hard-lock.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-131759
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e2412050");
  # https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43161-50a7@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?64d9cfc1");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43161");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43161");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}