0

I need to investigate for the security hole ALAS-2019-1149(https://alas.aws.amazon.com/ALAS-2019-1149.html) which is report ed by AWS. I saw in the session "Issue Correction" Run yum update kernel to update your system. I understood that I only update the kernel without rebooting the target server

I just updated the kernel with that command line

[root@ip-10-0-10-67 ~]# uname -r
4.4.11-23.53.amzn1.x86_64
[root@ip-10-0-10-67 ~]# yum update kernel
Loaded plugins: priorities, update-motd, upgrade-helper
amzn-main/latest                                                                                                                                              | 2.1 kB     00:00
amzn-updates/latest                                                                                                                                           | 2.5 kB     00:00
stns/x86_64                                                                                                                                                   | 2.5 kB     00:00
stns/x86_64/primary_db                                                                                                                                        | 9.0 kB     00:00
Resolving Dependencies
--> Running transaction check
---> Package kernel.x86_64 0:4.14.97-74.72.amzn1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=====================================================================================================================================================================================
 Package                               Arch                                  Version                                               Repository                                   Size
=====================================================================================================================================================================================
Installing:
 kernel                                x86_64                                4.14.97-74.72.amzn1                                   amzn-updates                                 21 M

Transaction Summary
=====================================================================================================================================================================================
Install  1 Package

Total download size: 21 M
Installed size: 90 M
Is this ok [y/d/N]: y
Downloading packages:
kernel-4.14.97-74.72.amzn1.x86_64.rpm                                                                                                                         |  21 MB     00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : kernel-4.14.97-74.72.amzn1.x86_64                                                                                                                                 1/1
  Verifying  : kernel-4.14.97-74.72.amzn1.x86_64                                                                                                                                 1/1

Installed:
  kernel.x86_64 0:4.14.97-74.72.amzn1

But when I checked kernel again, don't have nay changing update in kernel

[root@ip-10-0-10-67 ~]# uname -r
4.4.11-23.53.amzn1.x86_64

But I wonder how to verify the updating?

Thank in advance!

  • 2
    uname -r reports the currently running kernel. You cannot replace the underlying kernel while keeping the system on top of the kernel running (there are things like kpatch and similar which hot-patch an existing running kernel, but that's not what you are doing here). Thus, in order to run the new kernel you need to reboot the specific system. – Steffen Ullrich Feb 21 at 10:41
  • @SteffenUllrich, But AWS said that I only update the kernel and don't need to reboot server. Is it ok to fix the hole? – Sơn Lâm Feb 21 at 10:54
  • It is not enough to just install some fixed software but you have to stop running the vulnerable version and use the fixed one. This is true for the kernel too, i.e. a reboot is needed. – Steffen Ullrich Feb 21 at 11:26
  • @SteffenUllrich. What do you think about that information linuxjournal.com/content/…. From kernel-4 we don't need to reboot server for updating patch security holes – Sơn Lâm Feb 22 at 3:44
  • To cite myself: "there are things like kpatch and similar which hot-patch an existing running kernel, but that's not what you are doing here". kpatch and similar is exactly what this article is about and it does not apply to what you do: you install a new kernel and don't hot-patch an existing one. – Steffen Ullrich Feb 22 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.