Affected platforms running Arista EOS with OpenConfig configured

#!/usr/bin/env bash
# check_cve_2024_27892.sh
# Determine likely exposure to CVE-2024-27892 on an Arista EOS device.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

fail_unknown() {
  echo "UNKNOWN - $1"
  exit 2
}

# Use EOS local CLI helper if present.
if command -v Cli >/dev/null 2>&1; then
  CLI_CMD="Cli -c"
elif command -v FastCli >/dev/null 2>&1; then
  CLI_CMD="FastCli -p 15 -c"
else
  fail_unknown "Neither Cli nor FastCli found"
fi

run_cli() {
  # shellcheck disable=SC2086
  eval $CLI_CMD "$1" 2>/dev/null
}

ver_out="$(run_cli 'show version' )"
[ -n "$ver_out" ] || fail_unknown "Unable to read show version"

gnmi_out="$(run_cli 'show management api gnmi' )"
[ -n "$gnmi_out" ] || fail_unknown "Unable to read show management api gnmi"

# Extract EOS version from common output forms.
version="$(printf '%s
' "$ver_out" | grep -Eo 'Software image version: [^ ]+' | awk '{print $4}' | head -n1)"
if [ -z "$version" ]; then
  version="$(printf '%s
' "$ver_out" | grep -Eo 'version [0-9]+\.[0-9]+\.[0-9A-Za-z.]+' | awk '{print $2}' | head -n1)"
fi
[ -n "$version" ] || fail_unknown "Could not parse EOS version"

# Exposure condition from Arista advisory: OpenConfig/gNMI enabled with an SSL profile.
if printf '%s
' "$gnmi_out" | grep -qi 'Enabled: no transports enabled'; then
  echo "PATCHED - gNMI/OpenConfig transport is not enabled"
  exit 0
fi

if ! printf '%s
' "$gnmi_out" | grep -qi 'Enabled: yes'; then
  fail_unknown "Could not confirm whether gNMI transport is enabled"
fi

ssl_line="$(printf '%s
' "$gnmi_out" | grep -i 'SSL profile:' | head -n1)"
[ -n "$ssl_line" ] || fail_unknown "Could not parse SSL profile line"

if printf '%s
' "$ssl_line" | grep -qi 'SSL profile: none'; then
  echo "PATCHED - gNMI is enabled but no SSL profile is configured; Arista says CVE-2024-27892 requires an SSL profile"
  exit 0
fi

# Version helpers.
train="$(printf '%s' "$version" | awk -F. '{print $1"."$2}')"
rest="$(printf '%s' "$version" | cut -d. -f3-)"
[ -n "$train" ] || fail_unknown "Could not determine version train"

# Parse release number and flavor from last segment, e.g. 10M, 10.1M, 2F, 3M
# We only need enough fidelity for the affected/fixed thresholds in Advisory 0099.
num_part="$(printf '%s' "$rest" | sed -E 's/^([0-9]+(\.[0-9]+)?).*/\1/')"
flavor="$(printf '%s' "$rest" | sed -E 's/^[0-9]+(\.[0-9]+)?([A-Za-z]).*/\2/' | head -c1)"
[ -n "$num_part" ] || fail_unknown "Could not parse release number"
[ -n "$flavor" ] || fail_unknown "Could not parse release flavor"

verlte() {
  # returns true if $1 <= $2 using sort -V
  [ "$(printf '%s
%s
' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

is_vuln=0
reason=""

case "$train" in
  4.24)
    if [ "$flavor" = "M" ] && verlte "$num_part" "11"; then is_vuln=1; reason="4.24.11M and below affected"; fi
    ;;
  4.25)
    if [ "$flavor" = "M" ] && verlte "$num_part" "10"; then is_vuln=1; reason="4.25.10M and below affected"; fi
    ;;
  4.26)
    if [ "$flavor" = "M" ] && verlte "$num_part" "9"; then is_vuln=1; reason="4.26.9M and below affected"; fi
    ;;
  4.27)
    if [ "$flavor" = "M" ] && verlte "$num_part" "8"; then is_vuln=1; reason="4.27.8M and below affected"; fi
    ;;
  4.28)
    if [ "$flavor" = "M" ] && verlte "$num_part" "10"; then is_vuln=1; reason="4.28.10M and below affected"; fi
    ;;
  4.29)
    if [ "$flavor" = "M" ] && verlte "$num_part" "7"; then is_vuln=1; reason="4.29.7M and below affected"; fi
    ;;
  4.30)
    if [ "$flavor" = "M" ] && verlte "$num_part" "5"; then is_vuln=1; reason="4.30.5M and below affected"; fi
    ;;
  4.31)
    # Advisory text lists 4.31.2F and below as affected and 4.31.3M+ as fixed.
    if { [ "$flavor" = "F" ] && verlte "$num_part" "2"; } || { [ "$flavor" = "M" ] && verlte "$num_part" "2"; }; then
      is_vuln=1
      reason="4.31.2 and below affected"
    fi
    ;;
  *)
    # Later trains are assumed not affected unless vendor says otherwise.
    ;;
esac

if [ "$is_vuln" -eq 1 ]; then
  echo "VULNERABLE - EOS $version with gNMI enabled and SSL profile configured ($reason)"
  exit 1
fi

# Known fixed trains from Advisory 0099.
case "$train" in
  4.28)
    if [ "$flavor" = "M" ] && ! verlte "$num_part" "10"; then
      echo "PATCHED - EOS $version is at or above 4.28.11M"
      exit 0
    fi
    ;;
  4.29)
    if [ "$flavor" = "M" ] && ! verlte "$num_part" "7"; then
      echo "PATCHED - EOS $version is at or above 4.29.8M"
      exit 0
    fi
    ;;
  4.30)
    if [ "$flavor" = "M" ] && ! verlte "$num_part" "5"; then
      echo "PATCHED - EOS $version is at or above 4.30.6M"
      exit 0
    fi
    ;;
  4.31)
    if [ "$flavor" = "M" ] && ! verlte "$num_part" "2"; then
      echo "PATCHED - EOS $version is at or above 4.31.3M"
      exit 0
    fi
    ;;
esac

# For versions outside explicitly covered trains, we avoid guessing.
fail_unknown "Version $version not explicitly classified by this script; verify against current Arista advisory"