xz-vulnerability-check

CVE-2024-3094-checker.sh

#!/bin/bash

# Its a fork of code available at https://github.com/FabioBaroni/CVE-2024-3094-checker/blob/ebd22e6e2943cf56af7032324f17cf589aafc09b/CVE-2024-3094-checker.sh
# Added commands for MacOS

# script to detect CVE-2024-3094

# original script:
# https://www.openwall.com/lists/oss-security/2024/03/29/4

# modified (fixed and features added) by cyclone
# https://github.com/cyclone-github/scripts/blob/main/xz_cve-2024-3094-detect.sh

# tested on debian amd64

# https://nvd.nist.gov/vuln/detail/CVE-2024-3094
# https://github.com/advisories/GHSA-rxwq-x6h5-x525

# v1.0.0; 2024-03-29
# initial release

# v1.0.1; 2024-03-29
# https://github.com/cyclone-github/scripts/issues/1
# https://github.com/cyclone-github/scripts/issues/2
# https://github.com/cyclone-github/scripts/pull/3

# v1.0.2; 2024-03-30
# https://github.com/cyclone-github/scripts/issues/4

set -eu

echo "Checking system for CVE-2024-3094 Vulnerability..."
echo "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"

# find path to liblzma used by sshd
# adapted from https://www.openwall.com/lists/oss-security/2024/03/29/4
sshd_path=$(whereis -b sshd | awk '{print $2}')

if [[ "$(uname)" == "Darwin" ]]; then
	path=$(otool -L "$sshd_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
else
	path=$(ldd "$sshd_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
fi

# or find path to liblzma used by xz 
# https://github.com/cyclone-github/scripts/issues/4
if [ -z "$path" ]; then
    xz_path=$(whereis -b xz | awk '{print $2}')
	if [[ "$(uname)" == "Darwin" ]]; then
		path=$(otool -L "$xz_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
	else
		path=$(ldd "$xz_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
	fi
fi

if [ -z "$path" ]; then
    echo
    echo "Probably not vulnerable (liblzma not found)"
    exit
fi

# check for function signature
# adapted from https://www.openwall.com/lists/oss-security/2024/03/29/4
echo
echo "Checking for function signature in liblzma..."
if hexdump -ve '1/1 "%.2x"' "$path" | grep -q 'f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410'; then
    echo "Function signature in liblzma: VULNERABLE"
else
    echo "Function signature in liblzma: OK"
fi

# check xz version
echo
echo "Checking xz version..."
xz_version=$(xz --version | head -n1 | awk '{print $4}')
if [[ "$xz_version" == "5.6.0" || "$xz_version" == "5.6.1" ]]; then
    echo "xz version $xz_version: VULNERABLE"
else
    echo "xz version $xz_version: OK"
fi