Apple WebKit JavaScriptCore DFG JIT Type Confusion (Cassowary)

#!/usr/bin/env bash
# check_cve_2024_23222.sh
# Checks whether the host is vulnerable to CVE-2024-23222
# (WebKit type confusion in JSC DFG JIT)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

VULNERABLE=1
PATCHED=0
UNKNOWN=2

# Compare two version strings (returns 0 if $1 >= $2)
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -t. -k1,1n -k2,2n -k3,3n -C 2>/dev/null
  return $?
}

if [[ "$(uname -s)" == "Darwin" ]]; then
  SAFARI_PLIST="/Applications/Safari.app/Contents/Info.plist"
  if [[ -f "$SAFARI_PLIST" ]]; then
    SAFARI_VER=$(/usr/libexec/PlistBuddy -c 'Print CFBundleShortVersionString' "$SAFARI_PLIST" 2>/dev/null || echo "")
    if [[ -n "$SAFARI_VER" ]]; then
      if version_gte "$SAFARI_VER" "17.3"; then
        echo "PATCHED — Safari $SAFARI_VER >= 17.3"
        exit $PATCHED
      else
        echo "VULNERABLE — Safari $SAFARI_VER < 17.3"
        exit $VULNERABLE
      fi
    fi
  fi
  MACOS_VER=$(sw_vers -productVersion 2>/dev/null || echo "")
  if [[ -n "$MACOS_VER" ]]; then
    MAJOR=$(echo "$MACOS_VER" | cut -d. -f1)
    case "$MAJOR" in
      14)
        if version_gte "$MACOS_VER" "14.3"; then
          echo "PATCHED — macOS $MACOS_VER (Sonoma >= 14.3)"
          exit $PATCHED
        else
          echo "VULNERABLE — macOS $MACOS_VER (Sonoma < 14.3)"
          exit $VULNERABLE
        fi
        ;;
      13)
        if version_gte "$MACOS_VER" "13.6.4"; then
          echo "PATCHED — macOS $MACOS_VER (Ventura >= 13.6.4)"
          exit $PATCHED
        else
          echo "VULNERABLE — macOS $MACOS_VER (Ventura < 13.6.4)"
          exit $VULNERABLE
        fi
        ;;
      12)
        if version_gte "$MACOS_VER" "12.7.3"; then
          echo "PATCHED — macOS $MACOS_VER (Monterey >= 12.7.3)"
          exit $PATCHED
        else
          echo "VULNERABLE — macOS $MACOS_VER (Monterey < 12.7.3)"
          exit $VULNERABLE
        fi
        ;;
      *)
        if [[ "$MAJOR" -ge 15 ]]; then
          echo "PATCHED — macOS $MACOS_VER (post-Sonoma, not affected)"
          exit $PATCHED
        else
          echo "VULNERABLE — macOS $MACOS_VER (EOL, no patch available)"
          exit $VULNERABLE
        fi
        ;;
    esac
  fi
  echo "UNKNOWN — could not determine macOS or Safari version"
  exit $UNKNOWN
elif [[ "$(uname -s)" == "Linux" ]]; then
  WEBKIT_VER=""
  if command -v dpkg-query &>/dev/null; then
    WEBKIT_VER=$(dpkg-query -W -f='${Version}' libwebkit2gtk-4.0-37 2>/dev/null | sed 's/-.*//' || echo "")
    [[ -z "$WEBKIT_VER" ]] && WEBKIT_VER=$(dpkg-query -W -f='${Version}' libwebkit2gtk-4.1-0 2>/dev/null | sed 's/-.*//' || echo "")
  elif command -v rpm &>/dev/null; then
    WEBKIT_VER=$(rpm -q --qf '%{VERSION}' webkit2gtk3 2>/dev/null || echo "")
    [[ "$WEBKIT_VER" == *"not installed"* ]] && WEBKIT_VER=""
  fi
  if [[ -n "$WEBKIT_VER" ]]; then
    if version_gte "$WEBKIT_VER" "2.42.5"; then
      echo "PATCHED — WebKitGTK $WEBKIT_VER >= 2.42.5"
      exit $PATCHED
    else
      echo "VULNERABLE — WebKitGTK $WEBKIT_VER < 2.42.5"
      exit $VULNERABLE
    fi
  fi
  if command -v dpkg-query &>/dev/null; then
    WEBKIT_VER=$(dpkg-query -W -f='${Version}' libwpewebkit-1.0-3 2>/dev/null | sed 's/-.*//' || echo "")
  fi
  if [[ -n "$WEBKIT_VER" ]]; then
    if version_gte "$WEBKIT_VER" "2.42.5"; then
      echo "PATCHED — WPE WebKit $WEBKIT_VER >= 2.42.5"
      exit $PATCHED
    else
      echo "VULNERABLE — WPE WebKit $WEBKIT_VER < 2.42.5"
      exit $VULNERABLE
    fi
  fi
  echo "UNKNOWN — WebKitGTK/WPE WebKit not found on this Linux host"
  exit $UNKNOWN
else
  echo "UNKNOWN — unsupported platform $(uname -s)"
  exit $UNKNOWN
fi