Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143040)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370606);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-89495");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143040)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-143040 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: bound namelen in dlm_migrate_request_handler

    Patch series ocfs2/dlm: bound peer-controlled lengths in the o2dlm.

    The o2dlm receive handlers trust u8 length and count fields from the wire
    without bounding them, so a node in a DLM domain can corrupt or panic any
    other node with a malformed message.  Three defects:

      - dlm_migrate_request_handler() passes migrate->namelen unchecked to
        dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an
        o2dlm_mle slab object: a heap out-of-bounds write of up to ~215
        attacker-controlled bytes.

      - dlm_mig_lockres_handler() passes mres->lockname_len unchecked to
        dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname
        slab object: a heap out-of-bounds write of up to ~223 bytes.

      - the same handler trusts mres->num_locks without checking that the
        message is large enough to hold that many entries, so
        dlm_process_recovery_data() walks mres->ml[] past the kmalloc(data_len)
        copy and trips a BUG_ON (an out-of-bounds read ending in a panic).

    The other o2dlm receive handlers already reject an oversized name; the
    migration and recovery handlers have omitted it since the DLM was added
    (see the Fixes tags).  Patch 1 bounds namelen; patch 2 validates
    lockname_len, num_locks, and the payload size.  Conforming recovery and
    migration traffic is unaffected.

    o2net authenticates peers only by the DLM domain key, so any node that has
    joined the domain -- including a compromised or malicious member -- can
    send these messages.  There is no local trigger; the attacker must already
    be a member of the cluster.

    Each sink was confirmed under KASAN with an out-of-tree module mirroring
    it exactly -- a kmem_cache/kmalloc of the real destination size, then the
    same unclamped memcpy/loop: slab-out-of-bounds Write for the two writes,
    Read for the recovery walk, and a panic.  A userspace AddressSanitizer
    build faults identically under -m32 and -m64.  Scrubbed logs are available
    on request.

    I reported this privately to [email protected] and the ocfs2 maintainers
    on 2026-06-20; with no response after the standard embargo period I am
    posting the fix publicly.  I have no embargo requirement.


    This patch (of 2):

    A node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied
    name length (migrate->namelen) without bounding it.  dlm_init_mle() then
    copies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[]
    array of an o2dlm_mle slab object, so a malformed message from a cluster
    peer overflows the slab object by up to ~215 bytes: a heap out-of-bounds
    write of attacker-controlled data, reachable by any node in the domain.

    Reject an oversized name, the way dlm_master_request_handler() and the
    other o2dlm receive handlers already do; the migration handler omits the
    check entirely.  Conforming messages are unaffected.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-143040
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?21c1d019");
  # https://lore.kernel.org/linux-cve-announce/2026091108-CVE-2026-89495-980e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bcef88e5");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-89495");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-89495");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}