VMware Workstation/Fusion VMXNET3 TSO Integer Overflow Guest-to-Host Escape

#!/usr/bin/env bash
# CVE-2026-59346 Verification Script
# Checks VMware Workstation/Fusion for VMXNET3 integer overflow vulnerability
# Run on the HOST machine, not inside a guest VM
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -uo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
VULN_STATUS="UNKNOWN"

echo "=== CVE-2026-59346 Check: VMware VMXNET3 TSO Integer Overflow ==="
echo ""

# --- Detect VMware installation ---
VERSION_OUTPUT=""
if command -v vmware &>/dev/null; then
    VERSION_OUTPUT=$(vmware --version 2>/dev/null || true)
elif command -v vmrun &>/dev/null; then
    VERSION_OUTPUT=$(vmrun --version 2>/dev/null | head -1 || true)
elif [ -d "/Applications/VMware Fusion.app" ]; then
    PLIST="/Applications/VMware Fusion.app/Contents/Info.plist"
    if [ -f "$PLIST" ]; then
        VERSION_OUTPUT="VMware Fusion $(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST" 2>/dev/null || echo 'unknown')"
    fi
fi

if [ -z "$VERSION_OUTPUT" ]; then
    echo -e "${YELLOW}[*] VMware Workstation/Fusion not detected on this host.${NC}"
    echo "UNKNOWN"
    exit 2
fi

echo "[*] Detected: $VERSION_OUTPUT"
echo ""

# --- Version check ---
# Patched: 26H1u1 or any later release (26H2, 27H1, etc.)
# Affected: 25H2, 26H1 (without u1 suffix)
if echo "$VERSION_OUTPUT" | grep -qiE '26H1u[1-9]|26H[2-9]|2[7-9]H[12]'; then
    VULN_STATUS="PATCHED"
    echo -e "${GREEN}[+] Version is 26H1u1 or later. CVE-2026-59346 is PATCHED.${NC}"
elif echo "$VERSION_OUTPUT" | grep -qiE '25H2|26H1([^u]|$)'; then
    echo -e "${RED}[!] Version matches affected range (25H2 or 26H1).${NC}"
    VULN_STATUS="VULNERABLE"
    # --- Scan for VMXNET3 adapters in VM configs ---
    echo ""
    echo "[*] Scanning for VMs with VMXNET3 adapters..."
    VMX_COUNT=0
    VMXNET3_COUNT=0
    SEARCH_DIRS=("$HOME")
    [ -d "/var/lib/vmware" ] && SEARCH_DIRS+=("/var/lib/vmware")
    [ -d "$HOME/Virtual Machines" ] && SEARCH_DIRS+=("$HOME/Virtual Machines")
    [ -d "$HOME/Documents/Virtual Machines" ] && SEARCH_DIRS+=("$HOME/Documents/Virtual Machines")
    while IFS= read -r vmx; do
        VMX_COUNT=$((VMX_COUNT + 1))
        if grep -qi 'virtualDev.*=.*"vmxnet3"' "$vmx" 2>/dev/null; then
            VMXNET3_COUNT=$((VMXNET3_COUNT + 1))
            VM_NAME=$(grep -i 'displayName' "$vmx" 2>/dev/null | head -1 | sed 's/.*= *"//;s/".*//' || basename "$vmx")
            echo -e "    ${RED}[!] VMXNET3: $VM_NAME${NC} ($vmx)"
        fi
    done < <(find "${SEARCH_DIRS[@]}" -maxdepth 5 -name '*.vmx' -type f 2>/dev/null | sort -u)
    echo ""
    if [ $VMX_COUNT -eq 0 ]; then
        echo "    [*] No .vmx files found in common locations."
    elif [ $VMXNET3_COUNT -eq 0 ]; then
        echo -e "    ${GREEN}[+] 0 of $VMX_COUNT VM(s) use VMXNET3 — attack surface eliminated.${NC}"
        echo "    [*] Note: version is still vulnerable; patching recommended."
    else
        echo -e "    ${RED}[!] $VMXNET3_COUNT of $VMX_COUNT VM(s) use VMXNET3 — actively exposed.${NC}"
    fi
else
    echo -e "${YELLOW}[*] Version not recognized. Manually verify against VMSA-2026-0007.${NC}"
    VULN_STATUS="UNKNOWN"
fi

echo ""
echo "=== Result: $VULN_STATUS ==="

case $VULN_STATUS in
    PATCHED)    exit 0 ;;
    VULNERABLE) exit 1 ;;
    *)          exit 2 ;;
esac