OpenSSL 1

#!/usr/bin/env bash
# check_cve_2022_2097.sh
# Host-side triage for OpenSSL CVE-2022-2097
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

patched() { echo "PATCHED: $1"; exit 0; }
vulnerable() { echo "VULNERABLE: $1"; exit 1; }
unknown() { echo "UNKNOWN: $1"; exit 2; }

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

ver_ge() {
  # returns 0 if $1 >= $2
  ! ver_lt "$1" "$2"
}

get_os_field() {
  local key="$1"
  [ -r /etc/os-release ] || return 1
  awk -F= -v k="$key" '$1==k {gsub(/^"|"$/, "", $2); print $2}' /etc/os-release
}

if ! command -v openssl >/dev/null 2>&1; then
  unknown "openssl binary not found"
fi

OPENSSL_VER_FULL="$(openssl version 2>/dev/null || true)"
OPENSSL_VER="$(printf '%s' "$OPENSSL_VER_FULL" | awk '{print $2}')"
[ -n "$OPENSSL_VER" ] || unknown "unable to parse OpenSSL version"

ARCH="$(uname -m 2>/dev/null || echo unknown)"
BITS="$(getconf LONG_BIT 2>/dev/null || echo unknown)"
CPU_AES="no"
if grep -Eq '(^flags|^Features).*\baes\b' /proc/cpuinfo 2>/dev/null; then
  CPU_AES="yes"
fi

# Distro backport checks first, to avoid false positives from older version strings.
OS_ID="$(get_os_field ID 2>/dev/null || true)"
OS_VER="$(get_os_field VERSION_ID 2>/dev/null || true)"
OS_CODE="$(get_os_field VERSION_CODENAME 2>/dev/null || true)"

if command -v dpkg-query >/dev/null 2>&1; then
  PKG_VER="$(dpkg-query -W -f='${Version}' openssl 2>/dev/null || true)"
  if [ -n "$PKG_VER" ]; then
    if [ "$OS_ID" = "ubuntu" ]; then
      case "$OS_VER" in
        18.04)
          dpkg --compare-versions "$PKG_VER" ge '1.1.1-1ubuntu2.1~18.04.20' && patched "Ubuntu 18.04 package version includes fix ($PKG_VER)"
          ;;
        20.04)
          dpkg --compare-versions "$PKG_VER" ge '1.1.1f-1ubuntu2.16' && patched "Ubuntu 20.04 package version includes fix ($PKG_VER)"
          ;;
        21.10)
          dpkg --compare-versions "$PKG_VER" ge '1.1.1l-1ubuntu1.6' && patched "Ubuntu 21.10 package version includes fix ($PKG_VER)"
          ;;
        22.04)
          dpkg --compare-versions "$PKG_VER" ge '3.0.2-0ubuntu1.6' && patched "Ubuntu 22.04 package version includes fix ($PKG_VER)"
          ;;
      esac
    fi

    if [ "$OS_ID" = "debian" ] || [ "$OS_CODE" = "bullseye" ]; then
      dpkg --compare-versions "$PKG_VER" ge '1.1.1n-0+deb11u4' && patched "Debian bullseye package version includes fix ($PKG_VER)"
    fi
  fi
fi

if command -v rpm >/dev/null 2>&1 && rpm -q openssl >/dev/null 2>&1; then
  if rpm -q --changelog openssl 2>/dev/null | grep -q 'CVE-2022-2097'; then
    patched "RPM changelog indicates CVE-2022-2097 backport"
  fi
fi

# Architecture gates. This CVE needs 32-bit x86 + AES-NI.
case "$ARCH" in
  i386|i486|i586|i686) : ;;
  *) patched "host architecture is $ARCH, not 32-bit x86" ;;
esac

[ "$BITS" = "32" ] || patched "userspace is $BITS-bit, not 32-bit"
[ "$CPU_AES" = "yes" ] || patched "CPU AES-NI flag not present"

# Upstream version checks after distro backport checks.
case "$OPENSSL_VER" in
  1.1.1*)
    if ver_lt "$OPENSSL_VER" '1.1.1q'; then
      # If this is an RPM-based distro with an older-looking version string, we may still be backported.
      if command -v rpm >/dev/null 2>&1 && rpm -q openssl >/dev/null 2>&1; then
        unknown "older 1.1.1 version string ($OPENSSL_VER) on RPM system; verify vendor backport status manually"
      fi
      vulnerable "affected upstream 1.1.1 branch ($OPENSSL_VER) on 32-bit x86 with AES-NI; actual exploitability still requires AES-OCB usage"
    else
      patched "OpenSSL upstream version is $OPENSSL_VER (>= 1.1.1q)"
    fi
    ;;
  3.0.*)
    if ver_lt "$OPENSSL_VER" '3.0.5'; then
      if command -v rpm >/dev/null 2>&1 && rpm -q openssl >/dev/null 2>&1; then
        unknown "older 3.0.x version string ($OPENSSL_VER) on RPM system; verify vendor backport status manually"
      fi
      vulnerable "affected upstream 3.0.x branch ($OPENSSL_VER) on 32-bit x86 with AES-NI; actual exploitability still requires AES-OCB usage"
    else
      patched "OpenSSL upstream version is $OPENSSL_VER (>= 3.0.5)"
    fi
    ;;
  *)
    patched "OpenSSL version $OPENSSL_VER is outside the affected upstream branches for CVE-2022-2097"
    ;;
esac