Enhanced kernel package check with multiple versions installed

[future-ryunosuketanai]

Hello.
As stated in the title, how about expanding the checking targets for kernel packages that have multiple versions installed?

As shown below, I am using RHEL8.9.

$ cat /etc/redhat-release
Red Hat Enterprise Linux release 8.9 (Ootpa)

Additionally, the following kernel packages are installed.

$ uname -a
Linux ip-xxx.yyy.compute.internal 4.18.0-513.24.1.el8_9.x86_64 #1 SMP Thu Mar 14 14:20:09 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux

$ rpm -qa --queryformat "%{NAME} %{EPOCHNUM} %{VERSION} %{RELEAASE} %{ARCH}\n" | grep kernel
kernel 0 4.18.0 513.24.1.el8_9 x86_64
kernel 0 4.18.0 477.27.1.el8_8 x86_64
kernel-core 0 4.18.0 477.27.1.el8_8 x86_64
kernel-core 0 4.18.0 513.24.1.el8_9 x86_64
kernel-debug 0 4.18.0 477.27.1.el8_8 x86_64
kernel-debug 0 4.18.0 513.24.1.el8_9 x86_64
kernel-debug-core 0 4.18.0 477.27.1.el8_8 x86_64
kernel-debug-core 0 4.18.0 513.24.1.el8_9 x86_64
kernel-modules 0 4.18.0 477.27.1.el8_8 x86_64
kernel-modules 0 4.18.0 513.24.1.el8_9 x86_64
kernel-debug-modules 0 4.18.0 477.27.1.el8_8 x86_64
kernel-debug-modules 0 4.18.0 513.24.1.el8_9 x86_64
kernel-modules-extra 0 4.18.0 477.27.1.el8_8 x86_64
kernel-modules-extra 0 4.18.0 513.24.1.el8_9 x86_64
kernel-debug-modules-extra 0 4.18.0 477.27.1.el8_8 x86_64
kernel-debug-modules-extra 0 4.18.0 513.24.1.el8_9 x86_64
kernel-tools 0 4.18.0 513.24.1.el8_9 x86_64
kernel-tools-libs 0 4.18.0 513.24.1.el8_9 x86_64

If you run a scan in this environment, older versions of some kernel packages will be detected.
In my environment, the following two "old" versions were detected and stored in output results json.

• kernel-debug 0 4.18.0 477.27.1.el8_8 x86_64
• kernel-debug-modules-extra 0 4.18.0 477.27.1.el8_8 x86_64

When I checked the implementation code, it seems that only the following packages are checked.

• kernel
• kernel-devel
• kernel-core
• kernel-modules
• kernel-uek

vuls/scanner/utils.go

Lines 29 to 35 in ef2be3d

	case constant.RedHat, constant.Oracle, constant.CentOS, constant.Alma, constant.Rocky, constant.Amazon, constant.Fedora:
	switch pack.Name {
	case "kernel", "kernel-devel", "kernel-core", "kernel-modules", "kernel-uek":
	ver := fmt.Sprintf("%s-%s.%s", pack.Version, pack.Release, pack.Arch)
	return true, kernel.Release == ver
	}
	return false, false

So, my suggestion is to add the following kernel packages to the check list.

• kernel-debug
• kernel-debug-core
• kernel-debug-modules
• kernel-debug-modules-extra
• kernel-modules-extra

However, I'm wondering if I should add all this to the code, or if there's another, better way to express it.

Sincerely.

[MaineK00n]

In this case, kernel-debug* should not be collected since it is not a running kernel.