Canonical LXD HTTPS listener improper certificate validation trusted-client impersonation

#!/usr/bin/env bash
# CVE-2026-112816 LXD version check
# Exit 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

ver_ge() {
  awk -v a="$1" -v b="$2" 'BEGIN{ split(a,av,"."); split(b,bv,"."); for(i=1;i<=3;i++){ av[i]=av[i]+0; bv[i]=bv[i]+0; } if(av[1]>bv[1] || (av[1]==bv[1] && av[2]>bv[2]) || (av[1]==bv[1] && av[2]==bv[2] && av[3]>=bv[3])){ exit 0 } else { exit 1 } }'
  return $?
}

VRAW=""
if command -v lxd >/dev/null 2>&1; then
  VRAW=$(lxd --version 2>/dev/null | awk '{print $1}')
fi
if [ -z "$VRAW" ] && command -v snap >/dev/null 2>&1; then
  VRAW=$(snap list lxd 2>/dev/null | awk '/^lxd /{print $2}' | head -1)
fi
if [ -z "$VRAW" ]; then
  echo "UNKNOWN: LXD version not found"
  exit 2
fi

major=$(echo "$VRAW" | cut -d. -f1)
minor=$(echo "$VRAW" | cut -d. -f2)
case "$major.$minor" in
  4.0)
    patched_floor="4.0.15"
    ;;
  5.0)
    patched_floor="5.0.11"
    ;;
  5.21)
    patched_floor="5.21.9"
    ;;
  6.9|6.10)
    patched_floor="6.10.1"
    ;;
  *)
    if [ "$major" -gt 6 ] || { [ "$major" -eq 6 ] && [ "$minor" -gt 10 ]; }; then
      patched_floor="6.10.1"
    else
      echo "UNKNOWN: series $major.$minor not covered"
      exit 2
    fi
    ;;
esac

if ver_ge "$VRAW" "$patched_floor"; then
  echo "PATCHED: LXD $VRAW >= $patched_floor"
  exit 0
else
  echo "VULNERABLE: LXD $VRAW < $patched_floor"
  exit 1
fi