CVE-2022-0847.sh

#!/bin/bash
# 24-03-2022
# Enrico Pasqualotto epasqualotto AT backloop.biz
# run with --fix for auto-fix option

OS_DETECTED=0
fix=0
declare -A fixedVer
declare -A vulnVer

function vercomp () {
    if [[ $1 == $2 ]]
    then
        return 0
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    # fill empty fields in ver1 with zeros
    for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
    do
        ver1[i]=0
    done
    for ((i=0; i<${#ver1[@]}; i++))
    do
        if [[ -z ${ver2[i]} ]]
        then
            # fill empty fields in ver2 with zeros
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]}))
        then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]}))
        then
            return 2
        fi
    done
    return 0
}


function getRedHatPkgVer() {
    local package_names=( "$@" )

    pkgver=`rpm -qa --queryformat="%{NAME}-%{VERSION}-%{RELEASE}\n" "${package_names[@]}"`
    echo $pkgver

}

function getDebianPkgVer (){

        pkgver=`dpkg -s "$1" | grep Version | cut -d ":" -f2| cut -d' ' -f2`
        echo $pkgver

}

if [ "$1" == "--help" ]; then
	echo "Use --fix to patch your system"
	exit 0
elif [ "$1" == "--fix" ]; then
	fix=1
	echo "Run with auto-fix enabled!"
	sleep 2
fi


#OS CHECK

if [[ "$OSTYPE" != "linux-gnu"* ]]; then
	echo "O.S. $OSTYPE Not supported!"
	exit 1
fi

#ubuntu
if [ -f /etc/os-release ] && [ ! -f /etc/centos-release-upstream ]; then
	TMP_DISTRIB=`cat /etc/os-release | grep -m1 "^NAME" | cut -d "=" -f2 | sed s/\"//g`

	if [ "$TMP_DISTRIB" == "Ubuntu" ]; then

		OS_DETECTED=1

		DISTRIB=`cat /etc/os-release | grep -m1 "^NAME" | cut -d "=" -f2 | sed s/\"//g`
	        VERNAME=`cat /etc/os-release | grep -m1 "VERSION_CODENAME" | cut -d "=" -f2`
        	VER=`cat /etc/os-release | grep -m1 "VERSION_ID" | cut -d "=" -f2 | sed s/\"//g`

		echo "Detected O.S. : $DISTRIB $VER $VERNAME"
	fi
fi

# debian
if [ "$OS_DETECTED" == "0" ] && [ -f /etc/debian_version ]; then

        OS_DETECTED=1

	VER=`cat /etc/debian_version`
	DISTRIB=Debian
        VERNAME=$(. /etc/os-release && echo ${VERSION_CODENAME-stretch})

	echo "Detected O.S. : $DISTRIB $VER $VERNAME"

fi

# redhat
if [ "$OS_DETECTED" == "0" ] && [ -f /etc/redhat-release ]; then

	OS_DETECTED=1
	PARENT_DISTRIB="RedHat"
        DISTRIB=`cat /etc/os-release | grep -m1 "^NAME" | cut -d "=" -f2 | sed s/\"//g`
        VERNAME=`cat /etc/os-release | grep -m1 "PRETTY_NAME" | cut -d "=" -f2`
        VER=`cat /etc/os-release | grep -m1 "VERSION_ID" | cut -d "=" -f2 | sed s/\"//g`

        echo "Detected O.S. : $DISTRIB $VER $VERNAME"
fi

#CentOS based
if [ "$OS_DETECTED" == "0" ] && [ -f /etc/centos-release-upstream ]; then

        OS_DETECTED=1
	PARENT_DISTRIB="Centos"
        DISTRIB=`cat /etc/os-release | grep -m1 "^NAME" | cut -d "=" -f2 | sed s/\"//g`
        VERNAME=`cat /etc/os-release | grep -m1 "PRETTY_NAME" | cut -d "=" -f2`
        VER=`cat /etc/os-release | grep -m1 "VERSION_ID" | cut -d "=" -f2 | sed s/\"//g`

        echo "Detected O.S. : $DISTRIB $VER $VERNAME"
fi

if [ "$OS_DETECTED" == "0" ]; then
	echo "O.S. not supported!"
	exit 1
fi
#cat /etc/os-release | grep -m1 "NAME" | cut -d "=" -f2 | sed s/\"//g


if [ "$DISTRIB" == "Ubuntu" ]; then

	PACKAGE=linux-image
	
	fixedVer["1404"]="3.11.0-12.19"   #Trusty
	fixedVer["1604"]="4.4.0-2.16"      #Xenial
	fixedVer["1804"]="4.13.0-16.19"  #Bionic
	fixedVer["2004"]="5.4.0-9.12"        #Focal
	fixedVer["2110"]="5.13.0-35.40"        #Impish

	isinstalled=`dpkg -l | grep $PACKAGE | wc -l`

        if [ "$isinstalled" == "0" ]; then
                echo "No package found on your system. You are not vulnerable!"
                exit 0
	fi

	curver=`getDebianPkgVer "$PACKAGE"`
	#echo $curver
	#echo ${fixedVer[`echo $VER| sed 's/\.//'`]}

	if [ "${fixedVer[`echo $VER| sed 's/\.//'`]}" == "" ]; then
		echo "No patch available for your distribution/version"
		echo "Try mitigate with command: chmod 0755 /usr/bin/pkexec"
		exit 1
	fi

	if [ "$curver" == "${fixedVer[`echo $VER| sed 's/\.//'`]}" ]; then
		res='same'
		vuln=0
	else
		dpkg --compare-versions $curver lt ${fixedVer[`echo $VER| sed 's/\.//'`]}
		cmpres=$?
		case $cmpres in
        		0) 
				res='lower'
				vuln=1
				;;
	        	1) 
				res='greater'
				vuln=0
				;;
		esac
	fi
	echo "My version ($curver) is $res than version (${fixedVer[`echo $VER| sed 's/\.//'`]}) with the patch"
	if [ "$vuln" == "0" ]; then
		echo "System not vulnerable"
	else
		echo "System vulnerable!"

		if [ "$fix" == "1" ]; then
		
			isroot=`id -u`
			if [ "$isroot" != "0" ]; then
				echo "Auto-fix option need root privildge. Please run with sudo or as root"
				exit 1
			fi
			
			apt-get update
			apt-get -y install $PACKAGE

			newver=`getDebianPkgVer "$PACKAGE"`
			
			if [ "$curver" != "$newver" ]; then
				echo "Upgrade done"
				dpkg --compare-versions $newver lt ${fixedVer[`echo $VER| sed 's/\.//'`]}
		                cmpres=$?
                		case $cmpres in
		                        0) 
       		                        	res='lower'
               		                	vuln=1
                       		        ;;
                        		1) 
                                		res='greater'
                                		vuln=0
                                	;;
                		esac
        		
				echo "My version ($newver) is $res than version (${fixedVer[`echo $VER| sed 's/\.//'`]}) with the patch"
				echo "System no more vulnerable!"
			else
				echo "Attempt to install new version of pkg failed!"
			fi
		fi
	fi


elif [ "$DISTRIB" == "Debian" ]; then

	PACKAGE=linux
	
        fixedVer["stretch"]="4.9.228-1"
	fixedVer["buster"]="4.19.208-1"
	fixedVer["bulleye"]="5.10.103-1"
	vulnVer["bulleye"]="5.10.84-1"
	fixedVer["sid"]="5.16.14-1"

        isinstalled=`dpkg -l | grep $PACKAGE | wc -l`

        if [ "$isinstalled" == "0" ]; then
                echo "No package found on your system. You are not vulnerable!"
                exit 0
        fi

        curver=`getDebianPkgVer "$PACKAGE"`
        #echo $curver
        #echo ${fixedVer[$VERNAME]}

        isinstalled=`dpkg -l | grep $PACKAGE | wc -l`

        if [ "$isinstalled" == "0" ]; then
                echo "No package found on your system. You are not vulnerable!"
                exit 0
        fi

        curver=`getDebianPkgVer "$PACKAGE"`
        #echo $curver
        #echo ${fixedVer[$VERNAME]}

		myvulnver=${vulnVer[`echo $VERNAME| sed 's/\.//'`]}
		myfixedver=${fixedVer[`echo $VERNAME| sed 's/\.//'`]}
		
		if [ "$myvulnver" == "" ] && [ "$myfixedver" == "" ]; then  
		
			echo "No information available for your system. Sorry"
            exit 0
            
        elif [ "$myfixedver" != "" ]; then  
        
			if [ "$curver" == "$myfixedver" ]; then
				res='same'
				vuln=0
			else
				dpkg --compare-versions $curver lt $myfixedver
				cmpres=$?
				case $cmpres in
						0) 
						res='lower'
						vuln=1
						;;
						1) 
						res='greater'
						vuln=0
						;;
				esac
			fi
			echo "My version ($curver) is $res than version ($myfixedver) with the patch"
			if [ "$vuln" == "0" ]; then
				echo "System not vulnerable"
			else
				echo "System vulnerable!"

				if [ "$fix" == "1" ]; then
				
					isroot=`id -u`
					if [ "$isroot" != "0" ]; then
						echo "Auto-fix option need root privildge. Please run with sudo or as root"
						exit 1
					fi
					
					apt-get update
					apt-get -y install $PACKAGE

					newver=`getDebianPkgVer "$PACKAGE"`
					
					if [ "$curver" != "$newver" ]; then
						echo "Upgrade done"
						dpkg --compare-versions $newver lt $myfixedver
								cmpres=$?
								case $cmpres in
										0) 
												res='lower'
												vuln=1
											;;
										1) 
												res='greater'
												vuln=0
											;;
								esac
						
						echo "My version ($newver) is $res than version ($myfixedver) with the patch"
						echo "System no more vulnerable!"
					else
						echo "Attempt to install new version of pkg failed!"
					fi
				fi
			fi

        
        elif [ "$myvulnver" != "" ]; then  
              
			if [ "$curver" == "$myvulnver" ]; then
				res='same'
				vuln=1
			else
				dpkg --compare-versions $curver lt $myvulnver
				cmpres=$?
				case $cmpres in
						0) 
						res='lower'
						vuln=1
						;;
						1) 
						res='greater'
						vuln=0
						;;
				esac
			fi
			echo "My version ($curver) is $res than version ($myvulnver) vulnerable"
			if [ "$vuln" == "0" ]; then
				echo "System not vulnerable"
			else
				echo "System vulnerable!"

				if [ "$fix" == "1" ]; then
					echo "No fix available at this time"					
				fi
			fi
        else
			echo "?"
			exit 1
		fi

elif [ "$PARENT_DISTRIB" == "Centos" ] || [ "$PARENT_DISTRIB" == "RedHat" ]; then	

	vulnerable_versions=(
		'polkit-0.112-5.ael7b'
		'polkit-0.112-13.p1.el7a'
		'polkit-0.96-2.el6'
		'polkit-0.96-2.el6_0.1'
		'polkit-0.96-5.el6_4'
		'polkit-0.96-7.el6'
		'polkit-0.96-7.el6_6.1'
		'polkit-0.96-11.el6'
		'polkit-0.96-11.el6_10.1'
		'polkit-0.112-1.el7'
		'polkit-0.112-5.el7'
		'polkit-0.112-6.el7_2'
		'polkit-0.112-7.el7_2.2'
		'polkit-0.112-7.el7_2.3'
		'polkit-0.112-7.el7_2'
		'polkit-0.112-9.el7'
		'polkit-0.112-11.el7_3'
		'polkit-0.112-12.el7_3'
		'polkit-0.112-12.el7_4.1'
		'polkit-0.112-14.el7'
		'polkit-0.112-14.el7_5.1'
		'polkit-0.112-17.el7'
		'polkit-0.112-18.el7'
		'polkit-0.112-18.el7_6.1'
		'polkit-0.112-18.el7_6.2'
		'polkit-0.112-22.el7'
		'polkit-0.112-22.el7_7.1'
		'polkit-0.112-26.el7'
		'polkit-0.115-6.el8'
		'polkit-0.115-9.el8'
		'polkit-0.115-9.el8_1.1'
		'polkit-0.115-11.el8'
		'polkit-0.115-11.el8_2.1'
		'polkit-0.115-11.el8_3.2'
		'polkit-0.115-11.el8_4.1'
		'polkit-0.115-12.el8'
	)

	curver=`getRedHatPkgVer "polkit"`
	echo "Your polkit version is: $curver"
	
	vuln=0
	for test_package in "${vulnerable_versions[@]}"; do
		if [ "$test_package" == "$curver" ]; then
			vuln=1
		fi
	done
	
	if [ "$vuln" == "0" ]; then
		echo "System not vulnerable"
	else
		echo "System vulnerable!"
		
		if [ "$fix" == "1" ]; then
		
			isroot=`id -u`
			if [ "$isroot" != "0" ]; then
				echo "Auto-fix option need root privildge. Please run with sudo or as root"
				exit 1
			fi
			
			yum install -y polkit

			newver=`getRedHatPkgVer "polkit"`

			if [ "$curver" != "$newver" ]; then
					echo "Upgrade done"					

					echo "System no more vulnerable!"
			else
					echo "Attempt to install new version of pkg failed!"
			fi

        fi
		
	fi

else	
	echo "Fix and check not available for your distribution!"
	echo "Try mitigate with command: chmod 0755 /usr/bin/pkexec"
	echo $PARENT_DISTRIB
	exit 1
fi