Dolby UDC 4

#!/usr/bin/env python3
# verify_cve_2025_54957.py
# Determine likely exposure to CVE-2025-54957 from known version / patch-level facts.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import argparse
import re
import sys
from datetime import datetime


def parse_date(value):
    try:
        return datetime.strptime(value, "%Y-%m-%d").date()
    except Exception:
        return None


def parse_version(value):
    if value is None:
        return None
    m = re.match(r'^\s*(\d+)\.(\d+)(?:\.(\d+))?\s*$', value)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3) or 0)
    return (major, minor, patch)


def version_in_range(v, low, high):
    return low <= v <= high


def main():
    parser = argparse.ArgumentParser(description="Assess likely exposure to CVE-2025-54957 based on platform patch level or Dolby UDC version.")
    parser.add_argument("--platform", required=True, choices=["pixel", "android", "chromeos", "generic-udc", "windows"], help="Platform or assessment mode")
    parser.add_argument("--patch-level", help="Security patch level in YYYY-MM-DD format (for Android/Pixel/ChromeOS if known)")
    parser.add_argument("--udc-version", help="Dolby UDC version, e.g. 4.13")
    args = parser.parse_args()

    patch_date = parse_date(args.patch_level) if args.patch_level else None
    udc_version = parse_version(args.udc_version) if args.udc_version else None

    # Known vulnerable range from vendor/NVD
    vuln_low = (4, 5, 0)
    vuln_high = (4, 13, 999999)

    # Public downstream patch markers
    pixel_fixed = parse_date("2025-12-05")
    android_fixed = parse_date("2026-01-05")
    chromeos_first_fix = parse_date("2025-09-18")

    # Generic UDC version-only logic
    if args.platform == "generic-udc":
        if udc_version is None:
            print("UNKNOWN: provide --udc-version for generic-udc mode")
            sys.exit(2)
        if version_in_range(udc_version, vuln_low, vuln_high):
            print(f"VULNERABLE: Dolby UDC version {args.udc_version} falls in affected range 4.5 through 4.13")
            sys.exit(1)
        print(f"PATCHED: Dolby UDC version {args.udc_version} is outside the published affected range")
        sys.exit(0)

    # Pixel-specific public marker
    if args.platform == "pixel":
        if patch_date is not None:
            if patch_date >= pixel_fixed:
                print(f"PATCHED: Pixel patch level {args.patch_level} is at or newer than 2025-12-05")
                sys.exit(0)
            else:
                print(f"VULNERABLE: Pixel patch level {args.patch_level} predates 2025-12-05")
                sys.exit(1)
        if udc_version is not None:
            if version_in_range(udc_version, vuln_low, vuln_high):
                print(f"VULNERABLE: Dolby UDC version {args.udc_version} is in the affected range and no Pixel patch level was supplied")
                sys.exit(1)
            print(f"PATCHED: Dolby UDC version {args.udc_version} is outside the affected range")
            sys.exit(0)
        print("UNKNOWN: provide --patch-level or --udc-version for Pixel mode")
        sys.exit(2)

    # Generic Android public marker
    if args.platform == "android":
        if patch_date is not None:
            if patch_date >= android_fixed:
                print(f"PATCHED: Android patch level {args.patch_level} is at or newer than 2026-01-05")
                sys.exit(0)
            else:
                print(f"VULNERABLE: Android patch level {args.patch_level} predates 2026-01-05")
                sys.exit(1)
        if udc_version is not None:
            if version_in_range(udc_version, vuln_low, vuln_high):
                print(f"VULNERABLE: Dolby UDC version {args.udc_version} is in the affected range and no Android patch level was supplied")
                sys.exit(1)
            print(f"PATCHED: Dolby UDC version {args.udc_version} is outside the affected range")
            sys.exit(0)
        print("UNKNOWN: provide --patch-level or --udc-version for Android mode")
        sys.exit(2)

    # ChromeOS public marker from Project Zero timeline
    if args.platform == "chromeos":
        if patch_date is not None:
            if patch_date >= chromeos_first_fix:
                print(f"PATCHED: supplied ChromeOS patch/build date {args.patch_level} is on or after the first public binary-fix date 2025-09-18")
                sys.exit(0)
            else:
                print(f"VULNERABLE: supplied ChromeOS patch/build date {args.patch_level} predates 2025-09-18")
                sys.exit(1)
        if udc_version is not None:
            if version_in_range(udc_version, vuln_low, vuln_high):
                print(f"VULNERABLE: Dolby UDC version {args.udc_version} is in the affected range and no ChromeOS patch/build date was supplied")
                sys.exit(1)
            print(f"PATCHED: Dolby UDC version {args.udc_version} is outside the affected range")
            sys.exit(0)
        print("UNKNOWN: provide --patch-level or --udc-version for ChromeOS mode")
        sys.exit(2)

    # Windows is harder: public MSRC mapping exists, but a simple universal patch-level cutoff is not reliable here.
    if args.platform == "windows":
        if udc_version is not None:
            if version_in_range(udc_version, vuln_low, vuln_high):
                print(f"VULNERABLE: Dolby UDC version {args.udc_version} is in the affected range")
                sys.exit(1)
            print(f"PATCHED: Dolby UDC version {args.udc_version} is outside the affected range")
            sys.exit(0)
        print("UNKNOWN: Windows mode needs a trustworthy embedded Dolby UDC version from your inventory/SBOM data")
        sys.exit(2)

    print("UNKNOWN: unsupported assessment path")
    sys.exit(2)


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("UNKNOWN: interrupted")
        sys.exit(2)
    except Exception as exc:
        print(f"UNKNOWN: {exc}")
        sys.exit(2)