Inconsistent results detected by vulnerability Detector in E2E Tests

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.8.0-rc1	Vulnerability Detection	Manager	Packages	Ubuntu22

Description

In Release 4.8.0 - RC 1 - Vulnerability Detection E2E tests It was noted that the vulnerability detector identified distinct vulnerabilities depending on whether the module was activated before or after agents were registered.

This discrepancy in results could potentially be attributed to the adequacy of the timeout duration allocated for the E2E tests. Given a duration of 3 minutes per agent, certain vulnerabilities may not have been fully explored within this timeframe. Moreover, variations in architectures further compounded the issue. For instance, in the case of a Windows agent, the detector identified one architecture as "" when vulnerability detection was disabled prior to agent initialization, whereas it detected "x86_64" under different circumstances. Further research is required

CVE-2024-21412

        [
            "CVE-2024-21412",
            "Microsoft Windows 11 Pro 10.0.22621.1105",
            "10.0.22621.1105",
            ""
        ]

        [
            "CVE-2024-21412",
            "Microsoft Windows 11 Pro 10.0.22621.1105",
            "10.0.22621.1105",
            "x86_64"
        ]

Evidences

Report: https://github.com/wazuh/wazuh/files/15234960/Test_e2e_system_284_test_vulnerability_detector.zip

Note

Currently tests are being launched enabling modulesd debug. Further evidence will be provided on this issue as soon as possible

[Dwordcito]

This issue is probably related to how the wazuh-db returns the os information during a rescan after the on/off of the VD feature.

@sebasfalcone priority on this, please.

[MiguelazoDS]

Analysis

Environment

• Manager Ubuntu 22
• Agent Centos9
• Agent Windows 11

Scan during Syscollector synchronization events

2384 vulnerabilities detected

78 vulnerabilities for Ubuntu 22
2139 vulnerabilities for Centos 9
167 vulnerabilities for Windows 11

Scan after Syscollector synchronization has ended

2384 vulnerabilities detected

78 vulnerabilities for Ubuntu 22
2139 vulnerabilities for Centos 9
167 vulnerabilities for Windows 11

Comparison

The issue is easily reproduced

Not only for Windows

[MiguelazoDS]

Update

Multiple errors showed up when editing the yaml file in QA integration tests