Skip to main content
Information Security

Return to Question

Notice removed Draw attention by CommunityBot
Bounty Ended with Mark Koek's answer chosen by CommunityBot
Notice added Draw attention by Sibwara
Bounty Started worth 50 reputation by Sibwara
edited tags
Link
Sibwara
Sibwara
  • 1.4k
  • 8
  • 21
Source Link
Sibwara
Sibwara
  • 1.4k
  • 8
  • 21

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel.

For example:
USN-2946-1 ( CVE-2015-8812, CVE-2016-2085, CVE-2016-2550, CVE-2016-2847 )
USN-3018-1 ( CVE-2016-4482, CVE-2016-4565, CVE-2016-4569, CVE-2016-4578, CVE-2016-4580, CVE-2016-4913, CVE-2016-4997, CVE-2016-4998 )
...
USN-2359-1 ( CVE-2014-3601, CVE-2014-5077, CVE-2014-5471, CVE-2014-5472 )
...
...

All these vulnerabilities belong to the current installed kernel version: linux-image-3.13.0-24-generic_3.13.0-24.47

Linux mint is based on Ubuntu 14.04 LTS. But Ubuntu 14.04 LTS seems to use linux-image-3.13.0-96-generic.
I know that Ubuntu backport security patch, so the kernel version main number stay unchanged but the vulnerabilities are fixed.
If I'm correct when you have a vulnerability publicly exposed about linux-kernel 3.X.Y, linux make a version 3.X.Z and Ubuntu put the patch in the version 3.X.Y-1 (right?).
So If you are using linux kernel 3.13.0-24 but the last version is 3.13.0-96, you are missing all the security patches made by Canonical.

I have seen that linux-kernel 3.13.0-24 is officially the version supported by Qiana: http://mirror.metrocast.net/linuxmint-packages/list.php?release=Qiana

Qiana (linux mint 17) is a LTS version, so the security patches shall be pushed in the kernel.

My question is not about how to get a secure kernel, I know that I can use linux mint 17.1, 17.2, 18, etc. My question is about "how a LTS mint version can use a known vulnerable version of linux kernel"?

I guess possible answers are:

  1. you're wrong the kernel version 3.13.0-24 is not vulnerable
  2. Mint backports patches in the kernel without updating the last number (the 'Z' in 3.X.Y-Z)
  3. Yes mint use an older version of the kernel without the last security patches backported by Ubuntu so Qiana 17 LTS is full of kernel vuln

Note that nessus was not ready to perform specific Mint local security check, but it detected that the OS is Ubuntu based and make its checks knowing that:

The output of "uname -a" is :
Linux Tony-PC 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

The remote Debian system is :
jessie/sid

This is a Ubuntu system

Local security checks have been enabled for this host.

We can see that the date of build make some fear. And I have checked all the parameters is the system update: depository list is correct, apt-get update is good, apt-get upgrade is good, apt-get dist-upgrade is good too.