NASA CryptoLib Heap Buffer Overflow via TC Frame Length Underflow in Crypto_TC_ProcessSecurity

#!/usr/bin/env bash
# CVE-2025-29912 CryptoLib Heap Buffer Overflow Check
# Checks whether NASA CryptoLib <= 1.3.3 is present on this host.
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN (not found)

set -euo pipefail

VULN_MAX_MAJOR=1
VULN_MAX_MINOR=3
VULN_MAX_PATCH=3

check_version() {
  local ver="$1"
  local major minor patch
  major=$(echo "$ver" | cut -d. -f1)
  minor=$(echo "$ver" | cut -d. -f2)
  patch=$(echo "$ver" | cut -d. -f3)
  
  if [[ -z "$major" || -z "$minor" || -z "$patch" ]]; then
    return 2
  fi
  
  if (( major < VULN_MAX_MAJOR )); then
    return 0  # vulnerable
  elif (( major == VULN_MAX_MAJOR )); then
    if (( minor < VULN_MAX_MINOR )); then
      return 0  # vulnerable
    elif (( minor == VULN_MAX_MINOR )); then
      if (( patch <= VULN_MAX_PATCH )); then
        return 0  # vulnerable
      fi
    fi
  fi
  return 1  # patched
}

FOUND=0

# Check 1: Look for libcryptolib shared objects
for lib in $(find /usr /opt /home -name 'libcrypto_lib*' -o -name 'libCryptoLib*' -o -name 'libcryptolib*' 2>/dev/null || true); do
  echo "[*] Found CryptoLib artifact: $lib"
  FOUND=1
done

# Check 2: Look for CryptoLib source/build directories
for d in $(find /usr /opt /home /root -maxdepth 5 -type d -iname 'cryptolib' 2>/dev/null || true); do
  echo "[*] Found CryptoLib directory: $d"
  # Try to find version in CMakeLists.txt
  cmake_file="$d/CMakeLists.txt"
  if [[ -f "$cmake_file" ]]; then
    ver=$(grep -oP 'project\s*\(.*VERSION\s+\K[0-9]+\.[0-9]+\.[0-9]+' "$cmake_file" 2>/dev/null || true)
    if [[ -n "$ver" ]]; then
      echo "[*] Detected CryptoLib version: $ver"
      if check_version "$ver"; then
        echo "VULNERABLE - CryptoLib $ver is affected by CVE-2025-29912 (fixed in 1.4.0)"
        exit 0
      else
        echo "PATCHED - CryptoLib $ver is not affected by CVE-2025-29912"
        exit 1
      fi
    fi
  fi
  FOUND=1
done

# Check 3: Search for crypto_tc.c containing the vulnerable function
for f in $(find /usr /opt /home -name 'crypto_tc.c' 2>/dev/null || true); do
  if grep -q 'Crypto_TC_ProcessSecurity' "$f" 2>/dev/null; then
    echo "[*] Found CryptoLib source file: $f"
    if grep -q 'CRYPTO_LIB_ERR_TC_FRAME_LENGTH_UNDERFLOW' "$f" 2>/dev/null; then
      echo "PATCHED - Source contains the CVE-2025-29912 fix"
      exit 1
    else
      echo "VULNERABLE - Source lacks the CVE-2025-29912 underflow check"
      exit 0
    fi
  fi
done

if [[ $FOUND -eq 1 ]]; then
  echo "UNKNOWN - CryptoLib artifacts found but version could not be determined"
  exit 2
fi

echo "UNKNOWN - CryptoLib not found on this host (likely not applicable)"
exit 2