feat!(detector): detect windows with vuls2

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

Switch Windows OS CVE detection from gost to vuls2, reading vuls.db
(built by vuls-data-update, distributed via vuls-data-db).

• Windows KB-based detection now runs through the vuls2 backend instead of gost.
• MSRC "Exploit Status" is surfaced under CveContent.Optional["exploit"]
  (parity with the previous gost output).
• KB detection output aligned with the previous gost behavior.

Breaking change: Windows detection no longer depends on gost; it requires a
vuls.db containing the microsoft-* sources (see vuls-data-db#125 / #158).

Type of change

Please delete options that are not relevant.

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

Ran detection on the vulsio/integration Windows scan-result fixtures
(26 hosts) with both backends — the current gost-based detector and the new
vuls2-based detector against a microsoft-* vuls.db — and diffed the detected
CVE set per host. The same comparison runs in CI as a guard (vuls-data-db#158).

Per-host diff (gost-only = gost reports but vuls2 does not; vuls2-only = the reverse)

host	gost-only	vuls2-only	gost-only cause
windows_7	24	125	already patched (rollup coverage)
windows_81	54	232	already patched (rollup coverage)
windows_10_1709	0	198	—
windows_10_1803	0	151	—
windows_10_1809	0	136	—
windows_10_1903	0	52	—
windows_10_1909	0	29	—
windows_10_2004	0	3	—
windows_10_20h2	0	321	—
windows_10_21h1	144	28	Edge fuzzy-match (FP)
windows_10_21h2	1	330	already patched (rollup coverage)
windows_10_21h2_old	144	55	Edge fuzzy-match (FP)
windows_10_22h2	144	30	Edge fuzzy-match (FP)
windows_11_21h2	0	325	—
windows_11_22h2	0	348	—
windows_11_23h2	0	331	—
windows_11_24h2	13	325	Server-only CVE applied to client SKU (FP)
windows_11_25h2	14	320	Server-only CVE applied to client SKU (FP)
windows_server_2008	0	824	—
windows_server_2008_r2	637	63	already patched (rollup coverage)
windows_server_2012	1	48	already patched (rollup coverage)
windows_server_2012_r2	1	33	already patched (rollup coverage)
windows_server_2016	0	7	—
windows_server_2019	0	13	—
windows_server_2022	0	331	—
windows_server_2025	164	22	159 Edge fuzzy-match (FP) + 5 .NET feature-on-OS
TOTAL	1341	4680

gost-only causes (all non-vulnerable on these hosts)

• Edge fuzzy-match — 591: gost flags Microsoft Edge CVEs whenever Edge is present, ignoring the installed version. vuls2 compares the installed Edge (Chromium) version against the fixed-in version.
• Already patched / rollup coverage — ~718: gost's KB-chain walk is forward-only with incomplete supersedence data, so it does not see that an applied cumulative monthly rollup already supersedes an older fix KB, and re-reports CVEs the host is already patched against. vuls2 walks supersedence in both directions and credits that coverage. (Per host, gost-only CVEs are exactly those fixed at/before that host's actual patch level; both backends agree on CVEs fixed after it.)
• SKU mis-scoping — 27: gost applies a Windows Server-only fix KB to a Windows client SKU. vuls2 scopes matching by product and excludes it.

vuls2-only causes (real coverage gain; no false positive found in sampling)

• Microsoft Edge (Chromium) tracked by installed version.
• Past CVEs reachable only via transitive KB supersedence (gost's shallow chain misses them).
• OS-external Microsoft apps (Teams, Visual Studio Code) via installed packages.
• Secure Boot / firmware advisories (e.g., BootHole / KB5012170).

Information parity

For CVEs reported by both backends, the vuls2 output carries the same or richer
per-CVE content: title, CVSS (full vector), severity, references, and the MSRC
"Exploit Status" preserved under CveContent.Optional["exploit"].

Known boundary (not a regression)

vuls2 matches a product only when the host scan provides evidence the product is
present (an installed package, the OS release, or a KB that carries that product).
For "feature on OS" products such as .NET Framework x.y on Windows Server <ver>
(the 5 Server 2025 entries above), if the scan does not surface the relevant .NET
KB/package, vuls2 does not match — whereas gost matches by OS-name substring
regardless of whether the feature is installed. This is a scanner-input
completeness consideration; vuls2's behavior here is the more conservative/precise one.

Conclusion

Net improvement: removes gost false positives and expands real coverage, with no
loss of per-CVE information and no detection-logic regression found.

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

• feat(ci/db): add microsoft-(bulletin|cvrf|msuc|wsusscn2) vulsio/vuls-data-db#120
• feat(db/main): enable microsoft-* vulsio/vuls-data-db#125
• ci(diff-guard): add microsoft db override and include windows fixtures vulsio/vuls-data-db#158

[Copilot]

Pull request overview

This PR switches Windows CVE detection from the removed gost backend to the existing vuls2 backend backed by vuls.db, while preserving KB-based output fields and MSRC exploitability metadata.

Changes:

• Removes the gost package, configuration surface, dependency, and call sites.
• Routes Windows OS detection through vuls2.Detect.
• Adds Microsoft/Windows conversion, KB criterion handling, and tests for Windows KB detection output.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
detector/detector.go	Routes Windows package CVE detection through vuls2 and removes gost detection path.
detector/util.go	Removes gost DB validation and stale gost comment.
detector/vuls2/vuls2.go	Adds Windows pre-conversion, KB criterion propagation, and KB output conversion.
detector/vuls2/vendor.go	Adds Microsoft ecosystem/source mappings and MSRC optional metadata handling.
detector/vuls2/vuls2_test.go	Adds Windows/Microsoft preConvert and KB postConvert coverage.
config/config.go	Removes Gost from global config and report validation.
config/tomlloader.go	Stops initializing gost config from TOML.
config/vulnDictConf.go	Removes GostConf and related environment variable handling.
subcmds/server.go	Removes gost init/validation from server command.
subcmds/report.go	Removes gost default init from report command.
subcmds/report_windows.go	Removes gost default init from Windows report command.
subcmds/discover.go	Removes [gost] from generated config template.
server/server.go	Updates server detection call to the new vuls2-only signature.
reporter/util.go	Removes obsolete gost integration comment.
gost/gost.go	Deletes gost client construction and RedHat fill helper.
gost/microsoft.go	Deletes legacy Microsoft gost detector.
gost/microsoft_test.go	Deletes legacy Microsoft gost tests.
gost/redhat.go	Deletes legacy RedHat gost conversion/enrichment code.
gost/redhat_test.go	Deletes legacy RedHat gost tests.
gost/pseudo.go	Deletes no-op gost pseudo client.
gost/util.go	Deletes shared gost HTTP/helper utilities.
go.mod	Removes direct github.com/vulsio/gost dependency.
go.sum	Removes gost checksums.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shino]

https://github.com/future-architect/vuls/blob/958aab43b7093303f757664efc947d159e421f0e/.github/dependabot.yml has two gost entiries. It does no harm but better to remove?

[MaineK00n]

Good catch — removed in 8dd275d. I also dropped github.com/vulsio/go-exploitdb from the same two groups; it had become the same kind of stale entry after #2517 removed the dep from go.mod.

[shino]

🏁 🏁 🏁 🏁 🏁 🏁 🏁 🏁 🏁