Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146665)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373184);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id("CVE-2026-81003");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146665)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-146665 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/iucv: filter frames in afiucv_hs_rcv() by ingress device

    afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
    name fields in the transport header alone. No check is made against the
    net_device the frame arrived on.

    This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
    socket. Three problems follow.

    First, a frame arriving over HiperSockets can be delivered to a socket
    bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.
    iucv_sock_bind() takes the classic path whenever the requested userid
    matches iucv_userid, even on a guest that also has a HiperSockets device
    carrying the same identifier. The child socket created by
    afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
    transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
    The socket delivered to accept() is unusable.

    Second, a frame arriving on one netdev can be delivered to a socket bound
    to a different IQD device. Which can lead to
    - Accept-queue exhaustion (DoS)
    - Attacker-controlled peer identity in the child socket
    - Data injection into existing sockets
    - Fabric noise on the IQD fabric, where bogus replies are sent
    - killing established connections

    Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
    sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a
    namespace can be delivered to an IUCV socket. So a process in an
    unprivileged user and network namespace holding only the CAP_NET_RAW
    capability valid within that namespace can send a raw ETH_P_AF_IUCV frame
    on its own lo device and have it matched against init_net sockets.

    Fix all three by skipping any socket whose hs_dev does not match the
    ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress
    dev is never NULL, so classic sockets are skipped automatically. An unbound
    HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
    is only reachable from the exact IQD device it was bound to. Because hs_dev
    is always a device in init_net (iucv_sock_bind() scans
    for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress
    device belongs to another namespace never matches any socket.

    Note that AF_IUCV over HiperSockets provides no per-connection
    authentication: no sequence numbers, no TLS, no nonce. The four name fields
    identifying a connection are exchanged in plaintext on the shared
    HiperSockets segment (VCHID). Any host on the same HiperSockets segment
    could spoof any frame type against an existing connection. That is a
    protocol-level property unchanged by this patch. The fix reduces the attack
    surface to peers present on the same HiperSockets segment.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-146665
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e5dc3991");
  # https://lore.kernel.org/linux-cve-announce/2026091151-CVE-2026-81003-4d0a@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c24e8ec7");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-81003");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-81003");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}