Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142751)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370817);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-43114");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142751)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-142751 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

    New test case fails unexpectedly when avx2 matching functions are used.

    The test first loads a ranomly generated pipapo set
    with 'ipv4 . port' key, i.e.  nft -f foo.

    This works.  Then, it reloads the set after a flush:
    (echo flush set t s; cat foo) | nft -f -

    This is expected to work, because its the same set after all and it was
    already loaded once.

    But with avx2, this fails: nft reports a clashing element.

    The reported clash is of following form:

        We successfully re-inserted
          a . b
          c . d

    Then we try to insert a . d

    avx2 finds the already existing a . d, which (due to 'flush set') is marked
    as invalid in the new generation.  It skips the element and moves to next.

    Due to incorrect masking, the skip-step finds the next matching
    element *only considering the first field*,

    i.e. we return the already reinserted a . b, even though the
    last field is different and the entry should not have been matched.

    No such error is reported for the generic c implementation (no avx2) or when
    the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.

    Bisection points to
    7711f4bb4b36 (netfilter: nft_set_pipapo: fix range overlap detection)
    but that fix merely uncovers this bug.

    Before this commit, the wrong element is returned, but erronously
    reported as a full, identical duplicate.

    The root-cause is too early return in the avx2 match functions.
    When we process the last field, we should continue to process data
    until the entire input size has been consumed to make sure no stale
    bits remain in the map.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-142751
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5b89fe97");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2026-43114");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2466994");
  # https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?65c0a175");
  # https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?00ed29a5");
  # https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9d8b95d7");
  # https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c0f98a7");
  # https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6119fb2b");
  # https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8403c2e6");
  # https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cf7a2f6f");
  # https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a7f7ba12");
  # https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?643acdcc");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43114");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-43114");
  # https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fa8d59a0");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43114");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}