libssh2 Out-of-Bounds Write via Unchecked packet_length in ssh2_transport_read()

#!/usr/bin/env bash
# check_cve_2026_55200.sh — Detect CVE-2026-55200 (libssh2 OOB write)
# Run on: target Linux host
# Privileges: none (read-only package queries)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CVE="CVE-2026-55200"
FIXED_COMMIT="97acf3df"
VULN_MAX="1.11.1"

echo "[$CVE] Checking libssh2 installation..."

# Detect package manager and query version
PKG_VER=""
if command -v dpkg-query &>/dev/null; then
    PKG_VER=$(dpkg-query -W -f='${Version}' libssh2-1 2>/dev/null || true)
    if [ -z "$PKG_VER" ]; then
        PKG_VER=$(dpkg-query -W -f='${Version}' libssh2-1t64 2>/dev/null || true)
    fi
    PKG_MGR="dpkg"
elif command -v rpm &>/dev/null; then
    PKG_VER=$(rpm -q --qf '%{VERSION}-%{RELEASE}' libssh2 2>/dev/null || true)
    PKG_MGR="rpm"
elif command -v pacman &>/dev/null; then
    PKG_VER=$(pacman -Q libssh2 2>/dev/null | awk '{print $2}' || true)
    PKG_MGR="pacman"
else
    PKG_MGR="unknown"
fi

if [ -z "$PKG_VER" ]; then
    # Check if libssh2 is present as a shared library at all
    if ldconfig -p 2>/dev/null | grep -q libssh2; then
        echo "[$CVE] libssh2 shared library found but package version unknown."
        echo "[$CVE] Library path: $(ldconfig -p | grep libssh2 | head -1)"
        echo "UNKNOWN"
        exit 2
    else
        echo "[$CVE] libssh2 is not installed on this system."
        echo "PATCHED"
        exit 0
    fi
fi

echo "[$CVE] Detected libssh2 version: $PKG_VER (via $PKG_MGR)"

# Check for known-patched distro versions
patched=false

case "$PKG_MGR" in
    dpkg)
        # Debian/Ubuntu backport versions that contain the fix
        if echo "$PKG_VER" | grep -qE 'deb12u[1-9]'; then
            patched=true
        elif echo "$PKG_VER" | grep -qE 'deb13u[1-9]'; then
            patched=true
        elif echo "$PKG_VER" | grep -qE 'ubuntu0\.(26|25)\.[0-9]+\.[2-9]'; then
            patched=true
        elif dpkg --compare-versions "$PKG_VER" ge "1.11.1-3" 2>/dev/null; then
            patched=true
        fi
        ;;
    rpm)
        # SUSE/openSUSE fixed versions
        if echo "$PKG_VER" | grep -qE '160000\.4\.[1-9]'; then
            patched=true
        elif echo "$PKG_VER" | grep -qE '1\.11\.1-3'; then
            patched=true
        fi
        # RHEL 8.1+ reportedly not affected
        if [ -f /etc/redhat-release ]; then
            RHEL_VER=$(grep -oP '[0-9]+\.[0-9]+' /etc/redhat-release | head -1)
            if [ -n "$RHEL_VER" ]; then
                MAJOR=$(echo "$RHEL_VER" | cut -d. -f1)
                MINOR=$(echo "$RHEL_VER" | cut -d. -f2)
                if [ "$MAJOR" -ge 9 ] || { [ "$MAJOR" -eq 8 ] && [ "$MINOR" -ge 1 ]; }; then
                    echo "[$CVE] RHEL $RHEL_VER — Red Hat states libssh2 is not a supported component."
                    echo "[$CVE] Verify with: rpm -q libssh2 and check Red Hat advisory."
                    echo "PATCHED"
                    exit 0
                fi
            fi
        fi
        ;;
esac

if $patched; then
    echo "[$CVE] Installed version $PKG_VER contains the backported fix."
    echo "PATCHED"
    exit 0
fi

# Generic version comparison — anything <= 1.11.1 without a backport suffix is vulnerable
UPSTREAM_VER=$(echo "$PKG_VER" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+' || true)
if [ -z "$UPSTREAM_VER" ]; then
    echo "[$CVE] Cannot parse upstream version from: $PKG_VER"
    echo "UNKNOWN"
    exit 2
fi

# Compare versions (1.11.2 or higher would contain the fix if released)
IFS='.' read -r MAJ MIN PAT <<< "$UPSTREAM_VER"
if [ "$MAJ" -lt 1 ] || { [ "$MAJ" -eq 1 ] && [ "$MIN" -lt 11 ]; } || \
   { [ "$MAJ" -eq 1 ] && [ "$MIN" -eq 11 ] && [ "$PAT" -le 1 ]; }; then
    echo "[$CVE] Version $UPSTREAM_VER is <= $VULN_MAX and no backport detected."
    echo "VULNERABLE"
    exit 1
else
    echo "[$CVE] Version $UPSTREAM_VER is newer than $VULN_MAX."
    echo "PATCHED"
    exit 0
fi