What is the utility of the X-Vuls-Kernel-Version header when debian?

[joycedjamila]

Hello,

I have a question about the X-Vuls-Kernel-Version parameter. I'm using vuls in server mode, and using curl to send the scr packages. For a Debian, the Kernel-Version needs to be specified.

curl -X POST -H "Content-Type: text/plain" -H "X-Vuls-Server-Name: local_en_server"  -H "X-Vuls-OS-Family: debian "  -H "X-Vuls-OS-Release: 8"  --data-binary "@scan.txt" http://localhost:5515/vuls

X-Vuls-Kernel-Version header is required

In the documentation of vuls, the command that is given us :

uname -a | awk '{print $7}'

And the result is not a number.

root@4212a07ff56d:/# uname -a | awk '{print $7}'
Feb

My question is in the title, i don't know why this parameter is needed because if i fill it with something else like : aa , it works just fine.

curl -X POST -H "Content-Type: text/plain" -H "X-Vuls-Server-Name: local_en_server"  -H "X-Vuls-OS-Family: debian "  -H "X-Vuls-OS-Release: 8"  -H "X-Vuls-Kernel-Version: aa " --data-binary "@scan.txt" http://localhost:5515/vuls

[Jiab77]

@joycedjamila, I guess it's a bug and the $x value for awk is wrong. What debian version are you running? I'll try to fix it on my side.

[maxenced]

Hey there, very same question the @joycedjamila .
Same behavior on ubuntu 21.10 and 20.04 at least, but get the correct result on debian 10.

Looking at the full line (or uname -v), ubuntu do not provide a specific version at all (only date of build)

[MaineK00n]

@joycedjamila

In Debian, you can get the version of the running Kernel by using the command as documented. (This is different from release).

vagrant@debian10:~$ uname -a
Linux debian10.localdomain 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux
vagrant@debian10:~$ uname -a | awk '{print $7}'
4.19.208-1

However, if you are using Docker as shown below, you may not be able to get the kernel version as expected because the kernel of the host machine is displayed.

$ uname -a
Linux lize 5.13.0-28-generic #31~20.04.1-Ubuntu SMP Wed Jan 19 14:08:10 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$ uname -a | awk '{print $7}'
Jan
$ docker run --rm -it debian:11 /bin/bash
root@74fa44b54549:/# uname -a
Linux 74fa44b54549 5.13.0-28-generic #31~20.04.1-Ubuntu SMP Wed Jan 19 14:08:10 UTC 2022 x86_64 GNU/Linux
root@74fa44b54549:/# uname -a | awk '{print $7}'
Jan

---

My question is in the title, i don't know why this parameter is needed because if i fill it with something else like : aa , it works just fine.

Now, let me try to answer this question.

Here, it receives X-Vuls-Kernel-Version.

vuls/scanner/serverapi.go

Line 164 in 2923cbc

kernelVersion := header.Get("X-Vuls-Kernel-Version")

This X-Vuls-Kernel-Version is then set to the Version of the RunningKernel in ScanResult.

vuls/scanner/serverapi.go

Line 194 in 2923cbc

Version: kernelVersion,

The version of the RunningKernel is then used by OVAL and Debian Security Tracker as the version to compare against the linux package.

vuls/oval/debian.go

Lines 148 to 151 in 2923cbc

	r.Packages["linux"] = models.Package{
	Name: "linux",
	Version: r.RunningKernel.Version,
	NewVersion: newVer,

vuls/gost/debian.go

Lines 53 to 56 in 2923cbc

	r.Packages["linux"] = models.Package{
	Name: "linux",
	Version: r.RunningKernel.Version,
	NewVersion: newVer,

This means that if you make this version inappropriate, like aa, you will not be able to properly compare vulnerabilities in linux packages in OVAL and Debian Security Tracker.