OpenSSL DTLS Future Epoch Record Buffering Memory Exhaustion

#!/usr/bin/env bash
# check_cve_2026_54874.sh — Check for CVE-2026-54874 (DTLS memory amplification)
# Run on target hosts. No privileges required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

VERSION_STR=$(openssl version 2>/dev/null || true)
if [ -z "$VERSION_STR" ]; then
  echo "UNKNOWN — openssl binary not found in PATH"
  exit 2
fi

# Extract version number, e.g. "4.0.1" from "OpenSSL 4.0.1 ..."
VER=$(echo "$VERSION_STR" | grep -oP '\d+\.\d+\.\d+[a-z]*' | head -1)
if [ -z "$VER" ]; then
  echo "UNKNOWN — could not parse version from: $VERSION_STR"
  exit 2
fi

# Compare using sort -V (version sort)
check_fixed() {
  local current="$1" fixed="$2"
  if [ "$(printf '%s\n%s' "$fixed" "$current" | sort -V | head -1)" = "$fixed" ]; then
    return 0  # current >= fixed
  fi
  return 1
}

case "$VER" in
  4.0.*)
    if check_fixed "$VER" "4.0.2"; then
      echo "PATCHED — $VERSION_STR (fixed in 4.0.2)"
      exit 0
    fi
    ;;
  3.6.*)
    if check_fixed "$VER" "3.6.4"; then
      echo "PATCHED — $VERSION_STR (fixed in 3.6.4)"
      exit 0
    fi
    ;;
  3.5.*)
    if check_fixed "$VER" "3.5.8"; then
      echo "PATCHED — $VERSION_STR (fixed in 3.5.8)"
      exit 0
    fi
    ;;
  3.4.*)
    if check_fixed "$VER" "3.4.7"; then
      echo "PATCHED — $VERSION_STR (fixed in 3.4.7)"
      exit 0
    fi
    ;;
  3.0.*)
    if check_fixed "$VER" "3.0.22"; then
      echo "PATCHED — $VERSION_STR (fixed in 3.0.22)"
      exit 0
    fi
    ;;
  1.1.1*)
    echo "VULNERABLE — $VERSION_STR (check if >= 1.1.1zi with distro backport)"
    exit 1
    ;;
  1.0.2*)
    echo "VULNERABLE — $VERSION_STR (check if >= 1.0.2zr with distro backport)"
    exit 1
    ;;
  *)
    echo "UNKNOWN — unrecognized OpenSSL branch: $VERSION_STR"
    exit 2
    ;;
esac

echo "VULNERABLE — $VERSION_STR"
exit 1