runc /dev symlink following allows limited host filesystem integrity violations

#!/usr/bin/env bash
# CVE-2026-41579 Checker — runc /dev symlink integrity violation
# Run on container hosts. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RUNC_BIN=""
for candidate in runc /usr/bin/runc /usr/sbin/runc /usr/local/bin/runc /usr/local/sbin/runc; do
  if command -v "$candidate" &>/dev/null 2>&1; then
    RUNC_BIN="$candidate"
    break
  fi
done

if [ -z "$RUNC_BIN" ]; then
  echo "UNKNOWN — runc binary not found on this host."
  exit 2
fi

VERSION_OUTPUT=$("$RUNC_BIN" --version 2>/dev/null || true)
VERSION=$(echo "$VERSION_OUTPUT" | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?' || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse runc version from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected runc version: $VERSION"

# Check if Docker is the sole higher-level runtime (Docker is immune)
DOCKER_ONLY=false
if command -v docker &>/dev/null && ! command -v podman &>/dev/null; then
  # Check if containerd is used outside Docker context
  if ! systemctl is-active --quiet containerd 2>/dev/null || \
     (docker info 2>/dev/null | grep -qi 'containerd'); then
    DOCKER_ONLY=true
  fi
fi

if $DOCKER_ONLY; then
  echo "NOTE: Docker detected as sole runtime. Docker is IMMUNE to CVE-2026-41579"
  echo "      (read-only top layer masks malicious /dev symlinks)."
  echo "PATCHED — Docker's architecture mitigates this vulnerability."
  exit 0
fi

# Version comparison function
ver_to_num() {
  local IFS=.
  local parts=($1)
  printf '%d%03d%03d' "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}"
}

MAJMINPATCH=$(echo "$VERSION" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
RC_NUM=$(echo "$VERSION" | grep -oP 'rc\.\K[0-9]+' || echo "")
VER_NUM=$(ver_to_num "$MAJMINPATCH")

VULNERABLE=false

# Branch 1.3.x: fixed in 1.3.6
if [ "$VER_NUM" -lt $(ver_to_num "1.3.6") ]; then
  VULNERABLE=true
# Branch 1.4.x: fixed in 1.4.3
elif [ "$VER_NUM" -ge $(ver_to_num "1.4.0") ] && [ "$VER_NUM" -lt $(ver_to_num "1.4.3") ]; then
  VULNERABLE=true
# Branch 1.5.0-rc.x: fixed in 1.5.0-rc.3
elif [ "$MAJMINPATCH" = "1.5.0" ] && [ -n "$RC_NUM" ] && [ "$RC_NUM" -lt 3 ]; then
  VULNERABLE=true
fi

RUNTIMES=""
command -v podman &>/dev/null && RUNTIMES="${RUNTIMES}podman "
pgrep -x containerd &>/dev/null && RUNTIMES="${RUNTIMES}containerd "
[ -z "$RUNTIMES" ] && RUNTIMES="unknown "

if $VULNERABLE; then
  echo "VULNERABLE — runc $VERSION is affected by CVE-2026-41579."
  echo "  Exposed runtimes: $RUNTIMES"
  echo "  Fix: upgrade to runc 1.3.6, 1.4.3, or 1.5.0-rc.3+"
  exit 1
else
  echo "PATCHED — runc $VERSION is not affected by CVE-2026-41579."
  exit 0
fi