OP-TEE is a Trusted Execution Environment

#!/usr/bin/env bash
# check_optee_cve_2026_40290.sh
# Best-effort exposure check for CVE-2026-40290
# Logic:
#   - Vulnerable if OP-TEE version is >= 3.16.0 and < 4.11.0
#   - AND Secure Partition support appears enabled/configured
#   - Otherwise PATCHED if version >= 4.11.0
#   - UNKNOWN if evidence is incomplete
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

found_version=""
secure_partition="unknown"

ver_ge() {
    [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
    [ "$1" != "$2" ] && [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

note() {
    printf '%s\n' "$*" >&2
}

extract_version_from_file() {
    local f="$1"
    [ -r "$f" ] || return 1
    grep -Eao '([0-9]+\.[0-9]+(\.[0-9]+)?)' "$f" 2>/dev/null | head -n1
}

# 1) Try common package managers / metadata
for cmd in optee_os optee-version; do
    if command -v "$cmd" >/dev/null 2>&1; then
        v="$($cmd --version 2>/dev/null | grep -Eao '([0-9]+\.[0-9]+(\.[0-9]+)?)' | head -n1)"
        if [ -n "$v" ]; then
            found_version="$v"
            note "Found version via $cmd: $found_version"
            break
        fi
    fi
done

if [ -z "$found_version" ] && command -v dpkg-query >/dev/null 2>&1; then
    v="$(dpkg-query -W -f='${Version}\n' optee-os 2>/dev/null | grep -Eao '([0-9]+\.[0-9]+(\.[0-9]+)?)' | head -n1)"
    if [ -n "$v" ]; then
        found_version="$v"
        note "Found version via dpkg: $found_version"
    fi
fi

if [ -z "$found_version" ] && command -v rpm >/dev/null 2>&1; then
    v="$(rpm -q --qf '%{VERSION}\n' optee-os 2>/dev/null | grep -Eao '([0-9]+\.[0-9]+(\.[0-9]+)?)' | head -n1)"
    if [ -n "$v" ]; then
        found_version="$v"
        note "Found version via rpm: $found_version"
    fi
fi

# 2) Try common files / firmware blobs
if [ -z "$found_version" ]; then
    for f in \
        /etc/optee/version \
        /usr/share/optee/version \
        /sys/firmware/devicetree/base/firmware/optee/version \
        /boot/tee.bin \
        /boot/optee.bin \
        /boot/tee-header_v2.bin \
        /lib/firmware/tee.bin \
        /lib/firmware/optee.bin; do
        v="$(extract_version_from_file "$f")"
        if [ -n "$v" ]; then
            found_version="$v"
            note "Found version via file $f: $found_version"
            break
        fi
    done
fi

# 3) Try strings on blobs if present
if [ -z "$found_version" ] && command -v strings >/dev/null 2>&1; then
    for f in /boot/*.bin /lib/firmware/*.bin; do
        [ -e "$f" ] || continue
        v="$(strings "$f" 2>/dev/null | grep -Eao 'OP-TEE[^0-9]*([0-9]+\.[0-9]+(\.[0-9]+)?)' | grep -Eao '([0-9]+\.[0-9]+(\.[0-9]+)?)' | head -n1)"
        if [ -n "$v" ]; then
            found_version="$v"
            note "Found version via strings on $f: $found_version"
            break
        fi
    done
fi

# Detect CFG_SECURE_PARTITION=y from likely build/config artifacts
for f in \
    /etc/optee/conf.mk \
    /usr/share/optee/conf.mk \
    /boot/conf.mk \
    /boot/optee.conf \
    ./conf.mk \
    ./out/conf.mk \
    ./out/arm-plat-*/conf.mk \
    ./core/arch/arm/plat-*/conf.mk; do
    # shellcheck disable=SC2086
    for realf in $f; do
        [ -r "$realf" ] || continue
        if grep -Eq '^\s*CFG_SECURE_PARTITION\s*=\s*y\s*$' "$realf" 2>/dev/null; then
            secure_partition="enabled"
            note "Detected CFG_SECURE_PARTITION=y in $realf"
            break 2
        fi
        if grep -Eq '^\s*CFG_SECURE_PARTITION\s*=\s*n\s*$' "$realf" 2>/dev/null; then
            secure_partition="disabled"
            note "Detected CFG_SECURE_PARTITION=n in $realf"
        fi
    done
done

# Heuristic fallback: SPMC docs/manifests / filenames may indicate Secure Partition support
if [ "$secure_partition" = "unknown" ]; then
    for f in /boot/*spmc* /boot/*secure*partition* ./out/*spmc* ./out/*secure*partition*; do
        [ -e "$f" ] || continue
        secure_partition="enabled"
        note "Heuristic hit for Secure Partition/SPMC artifact: $f"
        break
    done
fi

# Decision
if [ -n "$found_version" ]; then
    if ver_ge "$found_version" "4.11.0"; then
        echo "PATCHED"
        exit 0
    fi

    if ver_ge "$found_version" "3.16.0" && ver_lt "$found_version" "4.11.0"; then
        if [ "$secure_partition" = "enabled" ]; then
            echo "VULNERABLE"
            exit 1
        elif [ "$secure_partition" = "disabled" ]; then
            echo "PATCHED"
            note "Installed version is in affected range, but CFG_SECURE_PARTITION appears disabled."
            exit 0
        else
            echo "UNKNOWN"
            note "Version is in affected range, but Secure Partition enablement could not be determined."
            exit 2
        fi
    fi
fi

echo "UNKNOWN"
if [ -z "$found_version" ]; then
    note "Could not determine OP-TEE version from package metadata or firmware files."
fi
if [ "$secure_partition" = "unknown" ]; then
    note "Could not determine whether CFG_SECURE_PARTITION is enabled."
fi
exit 2