Go crypto/tls server-side memory exhaustion via repeated ECH outer extension references

#!/usr/bin/env bash
# CVE-2026-97031 — Go crypto/tls ECH Memory Exhaustion Checker
# Scans Go toolchain and compiled binaries for vulnerable versions.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -uo pipefail

VULN=0; CHECKED=0; OK=0

is_vulnerable() {
  local v="${1#go}"
  local maj min pat
  IFS='.' read -r maj min pat <<< "$v"
  pat="${pat:-0}"
  [[ "$maj" -ne 1 ]] && return 2
  # ECH server support added in Go 1.24; earlier versions not affected
  [[ "$min" -lt 24 ]] && return 1
  # 1.24.x-1.25.x: vulnerable, EOL, no fix backported
  [[ "$min" -lt 26 ]] && return 0
  # 1.26.x: fixed in 1.26.9
  if [[ "$min" -eq 26 ]]; then
    [[ "$pat" -lt 9 ]] && return 0 || return 1
  fi
  # 1.27.x: fixed in 1.27.2
  if [[ "$min" -eq 27 ]]; then
    [[ "$pat" -lt 2 ]] && return 0 || return 1
  fi
  # 1.28+: patched
  return 1
}

check_ver() {
  local label="$1" ver="$2"
  CHECKED=$((CHECKED+1))
  if is_vulnerable "$ver"; then
    echo "[!] VULNERABLE: $label ($ver)"
    VULN=$((VULN+1))
  else
    echo "[+] PATCHED:    $label ($ver)"
    OK=$((OK+1))
  fi
}

echo "=== CVE-2026-97031 Scanner ==="
echo "Go crypto/tls ECH outer extension memory exhaustion"
echo "Vuln range: go1.24.0 - go1.26.8, go1.27.0 - go1.27.1"
echo "Fixed in:   go1.26.9, go1.27.2"
echo ""

# 1. Check Go toolchain
if command -v go &>/dev/null; then
  GV=$(go version 2>/dev/null | awk '{print $3}')
  check_ver "go toolchain" "$GV"
else
  echo "[i] No Go toolchain in PATH"
fi

# 2. Scan Go binaries
SCAN_DIRS="/usr/local/bin /usr/bin /opt /srv"
echo ""
echo "Scanning Go binaries in: $SCAN_DIRS"
for d in $SCAN_DIRS; do
  [[ -d "$d" ]] || continue
  while IFS= read -r -d '' bin; do
    BV=""
    if command -v go &>/dev/null; then
      BV=$(go version "$bin" 2>/dev/null | awk '{print $2}') || true
    fi
    if [[ -z "$BV" ]]; then
      BV=$(strings "$bin" 2>/dev/null | grep -oP 'go1\.\d+\.\d+' | head -1) || true
    fi
    [[ -z "$BV" ]] && continue
    check_ver "$bin" "$BV"
  done < <(find "$d" -maxdepth 3 -type f -executable -print0 2>/dev/null)
done

# 3. Check running Go processes
echo ""
echo "Checking running processes..."
for pid in /proc/[0-9]*/exe; do
  exe=$(readlink "$pid" 2>/dev/null) || continue
  [[ -f "$exe" ]] || continue
  RV=$(strings "$exe" 2>/dev/null | grep -oP 'go1\.\d+\.\d+' | head -1) || true
  [[ -z "$RV" ]] && continue
  pname=$(basename "$exe")
  pidnum=$(echo "$pid" | grep -oP '\d+')
  # Deduplicate: only check each binary once
  check_ver "PID $pidnum ($pname)" "$RV"
done 2>/dev/null

echo ""
echo "=== Result ==="
echo "Checked: $CHECKED | Vulnerable: $VULN | Patched: $OK"
if [[ "$CHECKED" -eq 0 ]]; then
  echo "UNKNOWN — no Go binaries found"
  exit 2
elif [[ "$VULN" -gt 0 ]]; then
  echo "VULNERABLE — $VULN binary(ies) on affected Go runtime"
  echo "NOTE: Only exploitable if ECH server is configured (EncryptedClientHelloKeys set)"
  exit 1
else
  echo "PATCHED — all $OK Go binary(ies) on fixed versions"
  exit 0
fi