search

wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
https://wazuh.com/
Other
9.34k stars 1.48k forks source link

Inconsistent results detected by vulnerability Detector in E2E Tests #23327

Closed Rebits closed 1 week ago

Rebits commented 1 week ago
Wazuh version Component Install type Install method Platform
4.8.0-rc1 Vulnerability Detection Manager Packages Ubuntu22

Description

In Release 4.8.0 - RC 1 - Vulnerability Detection E2E tests It was noted that the vulnerability detector identified distinct vulnerabilities depending on whether the module was activated before or after agents were registered.

This discrepancy in results could potentially be attributed to the adequacy of the timeout duration allocated for the E2E tests. Given a duration of 3 minutes per agent, certain vulnerabilities may not have been fully explored within this timeframe. Moreover, variations in architectures further compounded the issue. For instance, in the case of a Windows agent, the detector identified one architecture as "" when vulnerability detection was disabled prior to agent initialization, whereas it detected "x86_64" under different circumstances. Further research is required

CVE-2024-21412

        [
            "CVE-2024-21412",
            "Microsoft Windows 11 Pro 10.0.22621.1105",
            "10.0.22621.1105",
            ""
        ]
        [
            "CVE-2024-21412",
            "Microsoft Windows 11 Pro 10.0.22621.1105",
            "10.0.22621.1105",
            "x86_64"
        ]

Evidences

Report: https://github.com/wazuh/wazuh/files/15234960/Test_e2e_system_284_test_vulnerability_detector.zip

[!NOTE] Currently tests are being launched enabling modulesd debug. Further evidence will be provided on this issue as soon as possible

Dwordcito commented 1 week ago

This issue is probably related to how the wazuh-db returns the os information during a rescan after the on/off of the VD feature.

@sebasfalcone priority on this, please.

MiguelazoDS commented 1 week ago

Analysis

Environment

image

Scan during Syscollector synchronization events

2384 vulnerabilities detected image

78 vulnerabilities for Ubuntu 22 2139 vulnerabilities for Centos 9 167 vulnerabilities for Windows 11

image

Scan after Syscollector synchronization has ended

2384 vulnerabilities detected image

78 vulnerabilities for Ubuntu 22 2139 vulnerabilities for Centos 9 167 vulnerabilities for Windows 11

image

Comparison

The issue is easily reproduced

image

Not only for Windows image

MiguelazoDS commented 1 week ago

Update

Multiple errors showed up when editing the yaml file in QA integration tests

image