A security regression

#!/usr/bin/env bash
# check-cve-2024-6387.sh
# Purpose: best-effort local assessment for CVE-2024-6387 (regreSSHion)
# Output: VULNERABLE | PATCHED | UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

say() { printf '%s\n' "$1"; }
patched() { say 'PATCHED'; exit 0; }
vulnerable() { say 'VULNERABLE'; exit 1; }
unknown() { say 'UNKNOWN'; exit 2; }

if ! command -v sshd >/dev/null 2>&1 && ! command -v dpkg-query >/dev/null 2>&1 && ! command -v rpm >/dev/null 2>&1; then
  unknown
fi

OS_ID=""
OS_VER=""
OS_CODE=""
if [ -r /etc/os-release ]; then
  # shellcheck disable=SC1091
  . /etc/os-release
  OS_ID="${ID:-}"
  OS_VER="${VERSION_ID:-}"
  OS_CODE="${VERSION_CODENAME:-}"
fi

dpkg_ge() {
  dpkg --compare-versions "$1" ge "$2"
}

sortv_ge() {
  # Loose fallback comparator for RPM-ish version-release strings.
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

is_glibc() {
  if command -v ldd >/dev/null 2>&1; then
    ldd --version 2>&1 | head -n1 | grep -Eqi 'glibc|gnu libc'
    return $?
  fi
  return 1
}

check_deb() {
  local ver
  ver="$(dpkg-query -W -f='${Version}' openssh-server 2>/dev/null || true)"
  [ -n "$ver" ] || return 1

  case "$OS_ID:$OS_CODE" in
    ubuntu:focal|ubuntu:bionic|ubuntu:xenial|ubuntu:trusty)
      patched ;;
    ubuntu:jammy)
      if dpkg_ge "$ver" '1:8.9p1-3ubuntu0.10'; then patched; else vulnerable; fi ;;
    ubuntu:mantic)
      if dpkg_ge "$ver" '1:9.3p1-1ubuntu3.6'; then patched; else vulnerable; fi ;;
    ubuntu:noble)
      # Canonical notes noble's socket-activation patch likely blocks the Qualys exploitation approach,
      # but use the fixed package as the safe line.
      if dpkg_ge "$ver" '1:9.6p1-3ubuntu13.3'; then patched; else unknown; fi ;;
    debian:bullseye)
      patched ;;
    debian:bookworm)
      if dpkg_ge "$ver" '1:9.2p1-2+deb12u3'; then patched; else vulnerable; fi ;;
    debian:trixie|debian:sid|debian:forky)
      patched ;;
  esac

  return 2
}

check_rpm() {
  local vr
  vr="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' openssh-server 2>/dev/null || true)"
  [ -n "$vr" ] || return 1

  case "$OS_ID:$OS_VER" in
    rhel:9*|rocky:9*|almalinux:9*|ol:9*|centos:9*)
      if sortv_ge "$vr" '8.7p1-38.el9_4.1'; then patched; else vulnerable; fi ;;
    amzn:2023)
      if sortv_ge "$vr" '8.7p1-8.amzn2023.0.11'; then patched; else vulnerable; fi ;;
    sles:*|opensuse-leap:*|opensuse-tumbleweed:*)
      unknown ;;
  esac

  return 2
}

check_upstream_banner() {
  local banner ver
  banner="$(sshd -V 2>&1 || true)"
  ver="$(printf '%s' "$banner" | sed -n 's/.*OpenSSH_\([0-9][0-9.]*p[0-9][0-9]*\).*/\1/p' | head -n1)"
  [ -n "$ver" ] || unknown

  # Normalize a little for sort -V comparisons.
  if printf '%s\n%s\n' "$ver" '4.4p1' | sort -V | head -n1 | grep -qx "$ver"; then
    if [ "$ver" = '4.4p1' ] || printf '%s\n%s\n' "$ver" '4.4p1' | sort -V | tail -n1 | grep -qx "$ver"; then
      :
    fi
  fi

  # Old versions below 4.4p1 may be vulnerable unless separately backport-patched.
  if [ "$(printf '%s\n%s\n' "$ver" '4.4p1' | sort -V | head -n1)" = "$ver" ] && [ "$ver" != '4.4p1' ]; then
    unknown
  fi

  # 8.5p1 <= version < 9.8p1 => vulnerable upstream on glibc-based Linux.
  if [ "$(printf '%s\n%s\n' "$ver" '8.5p1' | sort -V | head -n1)" = '8.5p1' ] || [ "$ver" = '8.5p1' ]; then
    if [ "$(printf '%s\n%s\n' "$ver" '9.8p1' | sort -V | head -n1)" = "$ver" ] && [ "$ver" != '9.8p1' ]; then
      if is_glibc; then vulnerable; else unknown; fi
    fi
  fi

  patched
}

if command -v dpkg-query >/dev/null 2>&1; then
  check_deb
  rc=$?
  [ $rc -eq 2 ] || unknown
fi

if command -v rpm >/dev/null 2>&1; then
  check_rpm
  rc=$?
  [ $rc -eq 2 ] || unknown
fi

check_upstream_banner
unknown