0

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:

user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3.10.0-1062.4.1.el7.x86_64

When I run this command, which identifies the current kernel version that is being utilized on the server this is new version.

user@host [~]# uname –sr
Linux 3.10.0-1062.4.1.el7.x86_64

My security scanner reported that I have many vulnerabilities because of using kernel-3.10.0-327.el7.

Questions:

  1. Does this mean that this is false positive because I am not using this version on the server?
  2. Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?
1
  • I'm not confident enough to write an Answer, but I believe old versions are not purged on update in case you have issues booting and need to fall back to the older version. I believe you are correct that this is a false positive. For latest version, check your distro's pagkage manager. Jan 13, 2020 at 17:14

1 Answer 1

3

this is false positive because I am not using this version on the server?

Yes and no. It's an issue because the vulnerable version is installed, and can be loaded at any reboot by the user/operator. But at the moment, the running kernel is not the vulnerable one. So it indeed have the vulnerable version installed, but don't have the vulnerable version running.

Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

If you are using RedHat (it looks likely), you can use yum to see the latest version:

yum -v list package_name --show-duplicates

Installed Packages
kernel.x86_64                    3.10.0-123.4.el7                  @RHEL-76-x86_64-updates
kernel.x86_64                    3.10.0-234.1.el7                  @RHEL-77-x86_64-updates
Available Packages
kernel.x86_64                    3.10.0-345.1.el7                   RHEL-77-x86_64         
kernel.x86_64                    3.10.0-1234.5.6.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1345.8.9.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1579.2.4.el7                RHEL-77-x86_64-updates 

It will show you the installed version and some available versions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .