TianoCore EDK2 PXE ICMP error handler pre-boot buffer overflow via oversized packet

#!/usr/bin/env bash
# check_cve_2026_97631.sh — CVE-2026-97631 EDK2 PXE ICMP Buffer Overflow checker
# Run as root on target Linux host. Checks edk2 package version and BIOS info.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

echo "=== CVE-2026-97631 EDK2 PXE ICMP Buffer Overflow Check ==="
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "Host: $(hostname -f 2>/dev/null || hostname)"
echo ""

VULN_STATUS="UNKNOWN"

# Check 1: Is PXE boot likely enabled? (check EFI variables if available)
if [ -d /sys/firmware/efi ]; then
    echo "[INFO] UEFI firmware detected."
else
    echo "[INFO] Legacy BIOS or no EFI sysfs — may not use EDK2 PXE stack."
fi

# Check 2: edk2 / OVMF package version (virtual machines)
EDK2_PKG=""
if command -v rpm &>/dev/null; then
    EDK2_PKG=$(rpm -qa 'edk2*' 2>/dev/null | head -5)
elif command -v dpkg &>/dev/null; then
    EDK2_PKG=$(dpkg -l 'ovmf*' 'qemu-efi*' 'edk2*' 2>/dev/null | grep '^ii' | awk '{print $2"-"$3}' | head -5)
fi

if [ -n "$EDK2_PKG" ]; then
    echo "[INFO] Installed edk2/OVMF packages:"
    echo "$EDK2_PKG" | while read -r pkg; do echo "       $pkg"; done
    # Check for known-patched versions
    # RHEL 10: edk2-20251114-5.el10_2 or later is patched for other CVEs;
    # CVE-2026-97631 fix expected in future advisory
    # Upstream fix: edk2-stable202611+
    if echo "$EDK2_PKG" | grep -qiE 'stable2026(09|10|11|12)|stable2027|20261[0-9]'; then
        echo -e "${YELLOW}[CHECK] Package version may include the fix — verify against vendor advisory.${NC}"
        VULN_STATUS="UNKNOWN"
    elif echo "$EDK2_PKG" | grep -qiE 'stable202[0-5]|stable20260[1-8]|2022|2023|2024|2025'; then
        echo -e "${RED}[VULNERABLE] edk2 package version predates the fix (edk2-stable202608 or earlier).${NC}"
        VULN_STATUS="VULNERABLE"
    else
        echo -e "${YELLOW}[UNKNOWN] Cannot determine patch status from package version.${NC}"
    fi
else
    echo "[INFO] No edk2/OVMF package installed (expected on bare-metal hosts)."
fi

echo ""

# Check 3: BIOS/firmware version via dmidecode (bare-metal)
if command -v dmidecode &>/dev/null; then
    BIOS_VENDOR=$(dmidecode -s bios-vendor 2>/dev/null || echo "unknown")
    BIOS_VERSION=$(dmidecode -s bios-version 2>/dev/null || echo "unknown")
    BIOS_DATE=$(dmidecode -s bios-release-date 2>/dev/null || echo "unknown")
    echo "[INFO] BIOS Vendor:  $BIOS_VENDOR"
    echo "[INFO] BIOS Version: $BIOS_VERSION"
    echo "[INFO] BIOS Date:    $BIOS_DATE"
    # Heuristic: BIOS dated before 2026-10-15 (fix merge date) likely vulnerable
    if [ "$BIOS_DATE" != "unknown" ]; then
        BIOS_EPOCH=$(date -d "$BIOS_DATE" +%s 2>/dev/null || echo "0")
        FIX_EPOCH=$(date -d "2026-10-15" +%s)
        if [ "$BIOS_EPOCH" -gt 0 ] && [ "$BIOS_EPOCH" -lt "$FIX_EPOCH" ]; then
            echo -e "${RED}[LIKELY VULNERABLE] BIOS date predates upstream fix (2026-10-15).${NC}"
            if [ "$VULN_STATUS" != "VULNERABLE" ]; then VULN_STATUS="VULNERABLE"; fi
        elif [ "$BIOS_EPOCH" -ge "$FIX_EPOCH" ]; then
            echo -e "${YELLOW}[INFO] BIOS date is after fix merge — check with OEM for confirmation.${NC}"
        fi
    fi
else
    echo "[WARN] dmidecode not available — cannot check BIOS version. Install dmidecode."
fi

echo ""

# Check 4: Is PXE/network boot in the current boot order? (best-effort)
if command -v efibootmgr &>/dev/null; then
    PXE_ENTRIES=$(efibootmgr -v 2>/dev/null | grep -iE 'pxe|network|ipv[46]|uefi.*nic' || true)
    if [ -n "$PXE_ENTRIES" ]; then
        echo "[WARN] PXE/Network boot entries found in UEFI boot manager:"
        echo "$PXE_ENTRIES" | while read -r line; do echo "       $line"; done
        BOOT_ORDER=$(efibootmgr 2>/dev/null | grep 'BootOrder' || true)
        echo "       Current boot order: $BOOT_ORDER"
        echo -e "${YELLOW}[ACTION] Consider disabling PXE boot entries if not actively provisioning.${NC}"
    else
        echo -e "${GREEN}[GOOD] No PXE/Network boot entries found in UEFI boot manager.${NC}"
        if [ "$VULN_STATUS" = "VULNERABLE" ]; then
            echo "[NOTE] PXE not in boot order — attack surface is reduced but firmware is still unpatched."
        fi
    fi
else
    echo "[INFO] efibootmgr not available — cannot check boot order."
fi

echo ""
echo "=== RESULT ==="
case "$VULN_STATUS" in
    VULNERABLE)
        echo -e "${RED}VULNERABLE — EDK2 firmware/package predates CVE-2026-97631 fix.${NC}"
        echo "Action: Disable PXE boot if not needed. Apply edk2 package or OEM firmware update."
        exit 1
        ;;
    PATCHED)
        echo -e "${GREEN}PATCHED — EDK2 firmware/package includes CVE-2026-97631 fix.${NC}"
        exit 0
        ;;
    *)
        echo -e "${YELLOW}UNKNOWN — Could not definitively determine patch status.${NC}"
        echo "Action: Check OEM firmware advisory for your BIOS vendor/version."
        echo "        Disable PXE boot as a precaution if not actively provisioning."
        exit 2
        ;;
esac