OpenSSH < 9

#!/usr/bin/env bash
# check_cve_2024_6387.sh
# Detect likely exposure to CVE-2024-6387 (regreSSHion) on Linux hosts.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

status_vuln() {
  echo "VULNERABLE: $1"
  exit 1
}

status_patched() {
  echo "PATCHED: $1"
  exit 0
}

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

get_os_field() {
  local key="$1"
  [ -r /etc/os-release ] || return 1
  awk -F= -v k="$key" '$1==k {gsub(/^"|"$/, "", $2); print $2}' /etc/os-release
}

ver_ge() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  [ "$1" != "$2" ] && [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

normalize_openssh_ver() {
  # Input examples:
  # OpenSSH_9.2p1 Debian-2+deb12u5, OpenSSH_8.7p1, OpenSSH_9.6p1 Ubuntu-3ubuntu13.3
  local raw="$1"
  raw="${raw#OpenSSH_}"
  raw="${raw%% *}"
  raw="${raw%%,*}"
  echo "$raw"
}

get_sshd_version() {
  local out=""
  if have_cmd sshd; then
    out="$(sshd -V 2>&1 | head -n1 || true)"
    if [ -n "$out" ]; then
      normalize_openssh_ver "$out"
      return 0
    fi
  fi
  if have_cmd ssh; then
    out="$(ssh -V 2>&1 | head -n1 || true)"
    if [ -n "$out" ]; then
      normalize_openssh_ver "$out"
      return 0
    fi
  fi
  return 1
}

# 1) Prefer Debian/Ubuntu package-level checks because backports matter.
if have_cmd dpkg-query; then
  if dpkg-query -W -f='${Status}' openssh-server 2>/dev/null | grep -q 'install ok installed'; then
    pkg_ver="$(dpkg-query -W -f='${Version}' openssh-server 2>/dev/null)"
    os_id="$(get_os_field ID || true)"
    codename="$(get_os_field VERSION_CODENAME || true)"

    case "$os_id:$codename" in
      ubuntu:focal|ubuntu:bionic|ubuntu:xenial|ubuntu:trusty)
        status_patched "Ubuntu $codename is marked not affected by vendor advisory ($pkg_ver)"
        ;;
      ubuntu:jammy)
        if dpkg --compare-versions "$pkg_ver" ge '1:8.9p1-3ubuntu0.10'; then
          status_patched "Ubuntu Jammy package fixed ($pkg_ver)"
        else
          status_vuln "Ubuntu Jammy package predates fixed build ($pkg_ver)"
        fi
        ;;
      ubuntu:mantic)
        if dpkg --compare-versions "$pkg_ver" ge '1:9.3p1-1ubuntu3.6'; then
          status_patched "Ubuntu Mantic package fixed ($pkg_ver)"
        else
          status_vuln "Ubuntu Mantic package predates fixed build ($pkg_ver)"
        fi
        ;;
      ubuntu:noble)
        if dpkg --compare-versions "$pkg_ver" ge '1:9.6p1-3ubuntu13.3'; then
          status_patched "Ubuntu Noble package fixed ($pkg_ver)"
        else
          status_vuln "Ubuntu Noble package predates fixed build ($pkg_ver)"
        fi
        ;;
      debian:bullseye)
        if dpkg --compare-versions "$pkg_ver" ge '1:8.4p1-5+deb11u5'; then
          status_patched "Debian Bullseye package fixed ($pkg_ver)"
        else
          status_vuln "Debian Bullseye package predates fixed build ($pkg_ver)"
        fi
        ;;
      debian:bookworm)
        if dpkg --compare-versions "$pkg_ver" ge '1:9.2p1-2+deb12u5'; then
          status_patched "Debian Bookworm package fixed ($pkg_ver)"
        else
          status_vuln "Debian Bookworm package predates fixed build ($pkg_ver)"
        fi
        ;;
    esac
  fi
fi

# 2) RPM-family heuristic: changelog/backport check first, then version fallback.
if have_cmd rpm; then
  if rpm -q openssh-server >/dev/null 2>&1; then
    rpm_nvra="$(rpm -q openssh-server 2>/dev/null || true)"
    if rpm -q --changelog openssh-server 2>/dev/null | grep -q 'CVE-2024-6387'; then
      status_patched "RPM changelog indicates vendor fix for CVE-2024-6387 ($rpm_nvra)"
    fi
  fi
fi

# 3) Generic upstream-version fallback for portable/non-backported builds.
if ver="$(get_sshd_version)"; then
  if ver_lt "$ver" '4.4p1'; then
    status_vuln "OpenSSH version older than 4.4p1 ($ver); treat as vulnerable unless vendor explicitly backported old fixes"
  fi
  if ver_ge "$ver" '8.5p1' && ver_lt "$ver" '9.8p1'; then
    status_vuln "OpenSSH version is in upstream affected range 8.5p1-9.7p1 ($ver)"
  fi
  if ver_ge "$ver" '4.4p1' && ver_lt "$ver" '8.5p1'; then
    status_patched "OpenSSH version falls in upstream non-affected range 4.4p1-8.4p1 ($ver)"
  fi
  if ver_ge "$ver" '9.8p1'; then
    status_patched "OpenSSH version is at or above upstream fixed release 9.8p1 ($ver)"
  fi
fi

status_unknown "Could not determine vulnerable package or OpenSSH version reliably"