Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146149)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372609);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/27");

  script_cve_id("CVE-2026-80731");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146149)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-146149 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

    dev_validate_header() reads dev->hard_header_len directly when
    zero-padding short link layer headers for CAP_SYS_RAWIO holders:

        if (capable(CAP_SYS_RAWIO)) {
            memset(ll_header + len, 0, dev->hard_header_len - len);
            return true;
        }

    Packet send paths call dev_validate_header() on skbs whose headroom was
    allocated from an earlier hard_header_len read. If the device is
    reconfigured so that dev->hard_header_len increases before validation,
    the memset writes past the reserved buffer, an out-of-bounds write.

    This out-of-bounds write is masked in some SOCK_RAW paths today because
    the same concurrent increase can first make skb_push() exceed the
    reserved headroom and trigger skb_under_panic(). Remove the zero-padding
    branch before making those hard_header_len reads consistent, so the
    snapshot fixes do not turn a loud panic into a silent overwrite.

    This path is only reached for variable length L2 protocols, where
    len < hard_header_len but len >= min_header_len. No remaining in-tree
    variable length L2 protocol implements header_ops->validate, and the
    CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
    real value beyond allowing testing of intentionally malformed input.

    Drop the CAP_SYS_RAWIO branch. The remaining reads of
    dev->hard_header_len in dev_validate_header() are comparisons only and
    have no memory safety impact.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-146149
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4cba8028");
  # https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?645f2220");
  # https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12ad6ecd");
  # https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f8adf2e");
  # https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?03b9c832");
  # https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?720cdd22");
  # https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?72c1acad");
  # https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e808bdb");
  # https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2cca5e1e");
  # https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d4196230");
  # https://lore.kernel.org/linux-cve-announce/2026090358-CVE-2026-80731-49e3@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f05d2a36");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-80731");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-80731");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-80731");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.190.028.uelc20', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.028.uelc20', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.028.uelc20', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.190.028.uelc20', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}