Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142488)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370599);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-80590");

  script_name(english:"Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142488)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-142488 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: strip GSO state from fragments before reassembly

    A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
    an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
    inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
    fragment's skb as the head of the reassembled datagram, including its
    shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
    on frag_list with whatever linear/paged layout they arrived with.

    After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
    reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
    the next software segmentation point - udp_rcv_segment() on local
    delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
    path - hands it to skb_segment(). skb_segment()'s frag_list walk
    assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
    a tap by an unprivileged user in its own userns are enough:

      kernel BUG at net/core/skbuff.c:4899!
      Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
      CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
      RIP: 0010:skb_segment+0x20ca/0x48b0
      Call Trace:
       <TASK>
       __udp_gso_segment+0x29a/0x27d0
       udp4_ufo_fragment+0x458/0x6c0
       inet_gso_segment+0x429/0x1340
       skb_mac_gso_segment+0x233/0x4f0
       __skb_gso_segment+0x308/0x660
       udp_queue_rcv_skb+0x440/0xad0
       udp_unicast_rcv_skb+0xc7/0x2c0
       udp_rcv+0x16ce/0x2260
       ip_protocol_deliver_rcu+0x197/0x2d0
       ip_local_deliver+0x430/0x690
       ip_rcv+0x16f/0x1f0
       __netif_receive_skb_one_core+0x15e/0x1c0
       __netif_receive_skb+0x1e/0x110
       netif_receive_skb+0xf6/0x5c0
       tun_rx_batched.isra.0+0x3ab/0x790
       tun_get_user+0x17c3/0x3550
       tun_chr_write_iter+0xba/0x1b0
       vfs_write+0x646/0x1130
       </TASK>
      Kernel panic - not syncing: Fatal exception in interrupt

    This runs with BH disabled, so it is a panic rather than an oops. The
    same is reachable with CAP_NET_RAW in a netns where a defrag point
    precedes a GSO point, and from a guest whose VMM forwards
    virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
    commit 3dcbdb134f32 (net: gso: Fix skb_segment splat when splitting
    gso_size mangled skb having linear-headed frag_list) and by
    commit 9e4b7a99a03a (net: gso: fix panic on frag_list with mixed head
    alloc types) do not cover it: page-backed heads skip them, and kmalloc
    heads skip them when gso_size == skb_headlen(head), which the sender
    controls.

    An skb entering a frag queue is an IP fragment by definition and
    cannot legitimately carry GSO state: GRO does not merge fragments and
    the stack segments before it fragments, so only untrusted sources are
    affected. This has been reachable since
    commit f43798c27684 (tun: Allow GSO using virtio_net_hdr), the first
    path that let userspace attach GSO metadata to an IP fragment. Reset
    the GSO fields of every fragment as it is queued, in
    inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
    6lowpan reassembly share; then neither the head nor the frag_list
    members of the reassembled skb carry them (the members matter too:
    the ip_do_fragment()/ip6_fragment() fast paths send them out as they
    are). The head may remain CHECKSUM_PARTIAL; that is already accepted
    on receive and resolved by skb_checksum_help() in
    ip_do_fragment()/ip6_fragment() on forward.

    Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
    above, two further IPv4 frag_list geometries that reach
    BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
    fragment-header variant (udp6_ufo_fragment()) each panic the unpatched
    kernel; with this patch all four datagrams are delivered intact and
    nothing is logged.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-142488
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3d3b892");
  script_set_attribute(attribute:"see_also", value:"https://atomgit.com/src-openeuler/kernel/issues/18500");
  # https://lore.kernel.org/linux-cve-announce/2026082816-CVE-2026-80590-241e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?06f1694a");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-80590");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-80590");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1020e|20.1050e|20.1060e|20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1020e / 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1020e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}