X.Org Server/Xwayland XkbChangeTypesOfKey() buffer overflow

#!/usr/bin/env bash
# check-cve-2025-26597.sh
# Detect likely exposure to CVE-2025-26597 on Linux hosts.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason="Could not determine installed/fixed package versions"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

version_ge() {
  # usage: version_ge current fixed
  if have_cmd dpkg; then
    dpkg --compare-versions "$1" ge "$2"
    return $?
  fi
  # rpm-ish / generic fallback using sort -V
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | tail -n1)" = "$1" ]
}

get_os_id() {
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    echo "${ID:-unknown}:${VERSION_CODENAME:-${VERSION_ID:-unknown}}"
  else
    echo "unknown:unknown"
  fi
}

check_debian_ubuntu() {
  local os="$1"
  local id="${os%%:*}"
  local codename="${os#*:}"
  local xorg_ver=""
  local xwayland_ver=""
  local xorg_fixed=""
  local xwayland_fixed=""
  local vulnerable=0
  local unknown=0

  if have_cmd dpkg-query; then
    xorg_ver="$(dpkg-query -W -f='${Version}' xserver-xorg-core 2>/dev/null || true)"
    xwayland_ver="$(dpkg-query -W -f='${Version}' xwayland 2>/dev/null || true)"
  fi

  case "$id:$codename" in
    ubuntu:noble)    xorg_fixed='2:21.1.12-1ubuntu1.2'; xwayland_fixed='2:23.2.6-1ubuntu0.4' ;;
    ubuntu:jammy)    xorg_fixed='2:21.1.4-2ubuntu1.7~22.04.13'; xwayland_fixed='2:22.1.1-1ubuntu0.17' ;;
    ubuntu:focal)    xorg_fixed='2:1.20.13-1ubuntu1~20.04.19'; xwayland_fixed='' ;;
    ubuntu:oracular) xorg_fixed='2:21.1.13-2ubuntu1.2'; xwayland_fixed='2:24.1.2-1ubuntu0.4' ;;
    ubuntu:plucky)   xorg_fixed='2:21.1.16-1ubuntu1'; xwayland_fixed='2:24.1.5-1ubuntu1' ;;
    debian:bookworm) xorg_fixed='2:21.1.7-3+deb12u11'; xwayland_fixed='' ;;
    debian:bullseye) xorg_fixed='2:1.20.11-1+deb11u17'; xwayland_fixed='' ;;
    debian:trixie)   xorg_fixed='2:21.1.16-1.3+deb13u1'; xwayland_fixed='2:24.1.6-1' ;;
    *) return 2 ;;
  esac

  if [ -n "$xorg_ver" ] && [ -n "$xorg_fixed" ]; then
    if version_ge "$xorg_ver" "$xorg_fixed"; then
      :
    else
      vulnerable=1
      reason="xserver-xorg-core $xorg_ver is below fixed $xorg_fixed"
    fi
  elif [ -n "$xorg_fixed" ]; then
    unknown=1
  fi

  if [ -n "$xwayland_fixed" ]; then
    if [ -n "$xwayland_ver" ]; then
      if version_ge "$xwayland_ver" "$xwayland_fixed"; then
        :
      else
        vulnerable=1
        reason="xwayland $xwayland_ver is below fixed $xwayland_fixed"
      fi
    else
      unknown=1
    fi
  fi

  if [ "$vulnerable" -eq 1 ]; then
    status="VULNERABLE"
    return 1
  fi

  if [ -n "$xorg_ver" ] || [ -n "$xwayland_ver" ]; then
    status="PATCHED"
    reason="Installed Debian/Ubuntu package versions meet known fixed thresholds"
    return 0
  fi

  if [ "$unknown" -eq 1 ]; then
    status="UNKNOWN"
    reason="Expected package names not installed or not queryable"
    return 2
  fi

  return 2
}

extract_upstream_ver() {
  # Pull first semantic-looking version from stdin
  grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

check_upstream_fallback() {
  local xorg_up=""
  local xwayland_up=""
  local xorg_vuln=0
  local xwayland_vuln=0
  local found=0

  if have_cmd Xorg; then
    xorg_up="$(Xorg -version 2>&1 | extract_upstream_ver || true)"
    if [ -n "$xorg_up" ]; then
      found=1
      if version_ge "$xorg_up" '21.1.16'; then
        :
      else
        xorg_vuln=1
        reason="Xorg upstream version $xorg_up is below 21.1.16"
      fi
    fi
  fi

  if have_cmd Xwayland; then
    xwayland_up="$(Xwayland -version 2>&1 | extract_upstream_ver || true)"
    if [ -n "$xwayland_up" ]; then
      found=1
      if version_ge "$xwayland_up" '24.1.6'; then
        :
      else
        xwayland_vuln=1
        reason="Xwayland upstream version $xwayland_up is below 24.1.6"
      fi
    fi
  fi

  if [ "$found" -eq 0 ]; then
    status="UNKNOWN"
    reason="Neither Xorg nor Xwayland binaries were found"
    return 2
  fi

  if [ "$xorg_vuln" -eq 1 ] || [ "$xwayland_vuln" -eq 1 ]; then
    status="VULNERABLE"
    return 1
  fi

  status="PATCHED"
  reason="Installed upstream binary versions meet fixed thresholds"
  return 0
}

main() {
  local os
  os="$(get_os_id)"

  if check_debian_ubuntu "$os"; then
    echo "$status - $reason"
    exit 0
  else
    rc=$?
    if [ "$rc" -eq 1 ]; then
      echo "$status - $reason"
      exit 1
    fi
  fi

  check_upstream_fallback
  rc=$?
  echo "$status - $reason"
  exit "$rc"
}

main