Vulnerable stored Linux kernel version

Question

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:

user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3.10.0-1062.4.1.el7.x86_64

When I run this command, which identifies the current kernel version that is being utilized on the server this is new version.

user@host [~]# uname –sr
Linux 3.10.0-1062.4.1.el7.x86_64

My security scanner reported that I have many vulnerabilities because of using kernel-3.10.0-327.el7.

Questions:

1. Does this mean that this is false positive because I am not using this version on the server?
2. Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

Answer 1

this is false positive because I am not using this version on the server?

Yes and no. It's an issue because the vulnerable version is installed, and can be loaded at any reboot by the user/operator. But at the moment, the running kernel is not the vulnerable one. So it indeed have the vulnerable version installed, but don't have the vulnerable version running.

Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

If you are using RedHat (it looks likely), you can use yum to see the latest version:

yum -v list package_name --show-duplicates

Installed Packages
kernel.x86_64                    3.10.0-123.4.el7                  @RHEL-76-x86_64-updates
kernel.x86_64                    3.10.0-234.1.el7                  @RHEL-77-x86_64-updates
Available Packages
kernel.x86_64                    3.10.0-345.1.el7                   RHEL-77-x86_64         
kernel.x86_64                    3.10.0-1234.5.6.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1345.8.9.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1579.2.4.el7                RHEL-77-x86_64-updates 

It will show you the installed version and some available versions.