Morse Micro HaLowLink 2 morse.ko heap-based buffer overflow in Wi-Fi HaLow frame handling

#!/bin/sh
# verify-cve-2026-7763.sh
# Purpose: determine whether a Morse Micro / HaLowLink target is likely VULNERABLE,
# PATCHED, or UNKNOWN for CVE-2026-7763 by comparing the local software version
# to a vendor-confirmed fixed version supplied at runtime.
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / insufficient evidence

set -u

FIXED=""

usage() {
  echo "Usage: $0 --fixed <vendor-fixed-version>"
  echo "Example: $0 --fixed 2.11.12"
}

while [ $# -gt 0 ]; do
  case "$1" in
    --fixed)
      shift
      [ $# -gt 0 ] || { usage; echo "UNKNOWN: missing value for --fixed"; exit 2; }
      FIXED="$1"
      ;;
    -h|--help)
      usage
      exit 2
      ;;
    *)
      usage
      echo "UNKNOWN: unrecognized argument: $1"
      exit 2
      ;;
  esac
  shift
done

if [ -z "$FIXED" ]; then
  usage
  echo "UNKNOWN: vendor-fixed version not supplied"
  exit 2
fi

version_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

get_local_version() {
  # Prefer explicit HaLowLink / Morse release markers if present.
  for f in /etc/halowlink_release /etc/morse_release /etc/openwrt_release /etc/os-release; do
    if [ -r "$f" ]; then
      # shellcheck disable=SC2162
      while IFS= read line; do
        case "$line" in
          VERSION=*|DISTRIB_RELEASE=*|IMAGE_VERSION=*|HALOWLINK_VERSION=*|MORSE_VERSION=*)
            v=$(echo "$line" | sed 's/^[^=]*=//' | tr -d '"' | tr -d "'" )
            case "$v" in
              *[0-9]*.*[0-9]*)
                echo "$v"
                return 0
                ;;
            esac
            ;;
        esac
      done < "$f"
    fi
  done

  # Fall back to opkg package metadata if present.
  if command -v opkg >/dev/null 2>&1; then
    for pkg in halowlink morse-driver morse_firmware morse-firmware; do
      v=$(opkg list-installed 2>/dev/null | awk -v p="$pkg" '$1==p {print $3; exit}')
      case "$v" in
        *[0-9]*.*[0-9]*)
          echo "$v"
          return 0
          ;;
      esac
    done
  fi

  return 1
}

has_morse() {
  if [ -e /lib/modules/"$(uname -r)"/morse.ko ] || [ -e /lib/modules/"$(uname -r)"/updates/morse.ko ] || [ -e /lib/modules/"$(uname -r)"/extra/morse.ko ]; then
    return 0
  fi
  if command -v modinfo >/dev/null 2>&1 && modinfo morse >/dev/null 2>&1; then
    return 0
  fi
  if lsmod 2>/dev/null | awk '$1=="morse" {found=1} END{exit(found?0:1)}'; then
    return 0
  fi
  return 1
}

if ! has_morse; then
  echo "UNKNOWN: Morse Micro driver (morse.ko) not detected on this host"
  exit 2
fi

LOCAL_VERSION=$(get_local_version || true)

if [ -z "$LOCAL_VERSION" ]; then
  echo "UNKNOWN: morse.ko detected, but local software version could not be determined"
  exit 2
fi

# Normalize versions by trimming non-version suffixes if present.
LOCAL_CLEAN=$(echo "$LOCAL_VERSION" | sed 's/[^0-9.].*$//')
FIXED_CLEAN=$(echo "$FIXED" | sed 's/[^0-9.].*$//')

if [ -z "$LOCAL_CLEAN" ] || [ -z "$FIXED_CLEAN" ]; then
  echo "UNKNOWN: version parsing failed (local='$LOCAL_VERSION', fixed='$FIXED')"
  exit 2
fi

if version_lt "$LOCAL_CLEAN" "$FIXED_CLEAN"; then
  echo "VULNERABLE: local version $LOCAL_VERSION is older than fixed version $FIXED"
  exit 1
fi

echo "PATCHED: local version $LOCAL_VERSION is at or above fixed version $FIXED"
exit 0