Google Android cellular modem out-of-bounds write in ns_GetUserData

#!/usr/bin/env bash
# check_cve_2026_0113.sh
# Verify whether a connected Google Pixel device is patched for CVE-2026-0113
# Logic: Google publicly fixes this issue at security patch level 2026-03-05 or later.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/adb error

set -euo pipefail

TARGET_PATCH="2026-03-05"
SERIAL="${1:-}"
ADB=(adb)

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN: adb not found in PATH"
  exit 3
fi

if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

# Verify connectivity
if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN: no reachable adb device"
  exit 2
fi

getprop_safe() {
  local key="$1"
  "${ADB[@]}" shell getprop "$key" 2>/dev/null | tr -d '\r'
}

MANUFACTURER="$(getprop_safe ro.product.manufacturer)"
BRAND="$(getprop_safe ro.product.brand)"
MODEL="$(getprop_safe ro.product.model)"
PATCH="$(getprop_safe ro.build.version.security_patch)"
BUILD="$(getprop_safe ro.build.fingerprint)"

if [[ -z "$PATCH" ]]; then
  echo "UNKNOWN: could not read ro.build.version.security_patch"
  exit 2
fi

# Normalize vendor check for Google Pixel-family devices.
shopt -s nocasematch
IS_GOOGLE=0
if [[ "$MANUFACTURER" == *google* ]] || [[ "$BRAND" == *google* ]] || [[ "$MODEL" == Pixel* ]]; then
  IS_GOOGLE=1
fi
shopt -u nocasematch

if [[ "$IS_GOOGLE" -ne 1 ]]; then
  echo "UNKNOWN: device is not clearly a Google Pixel device"
  echo "manufacturer=$MANUFACTURER brand=$BRAND model=$MODEL patch=$PATCH"
  exit 2
fi

# YYYY-MM-DD sorts lexicographically.
if [[ "$PATCH" < "$TARGET_PATCH" ]]; then
  echo "VULNERABLE: Google device patch level is below $TARGET_PATCH"
  echo "manufacturer=$MANUFACTURER model=$MODEL patch=$PATCH"
  echo "build=$BUILD"
  exit 1
else
  echo "PATCHED: Google device patch level is $PATCH (>= $TARGET_PATCH)"
  echo "manufacturer=$MANUFACTURER model=$MODEL"
  echo "build=$BUILD"
  exit 0
fi