0

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:

user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3.10.0-1062.4.1.el7.x86_64

When I run this command, which identifies the current kernel version that is being utilized on the server this is new version.

user@host [~]# uname –sr
Linux 3.10.0-1062.4.1.el7.x86_64

My security scanner reported that I have many vulnerabilities because of using kernel-3.10.0-327.el7.

Questions:

  1. Does this mean that this is false positive because I am not using this version on the server?
  2. Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?
  • I'm not confident enough to write an Answer, but I believe old versions are not purged on update in case you have issues booting and need to fall back to the older version. I believe you are correct that this is a false positive. For latest version, check your distro's pagkage manager. – Mike Ounsworth Jan 13 at 17:14
2

this is false positive because I am not using this version on the server?

Yes and no. It's an issue because the vulnerable version is installed, and can be loaded at any reboot by the user/operator. But at the moment, the running kernel is not the vulnerable one. So it indeed have the vulnerable version installed, but don't have the vulnerable version running.

Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

If you are using RedHat (it looks likely), you can use yum to see the latest version:

yum -v list package_name --show-duplicates

Installed Packages
kernel.x86_64                    3.10.0-123.4.el7                  @RHEL-76-x86_64-updates
kernel.x86_64                    3.10.0-234.1.el7                  @RHEL-77-x86_64-updates
Available Packages
kernel.x86_64                    3.10.0-345.1.el7                   RHEL-77-x86_64         
kernel.x86_64                    3.10.0-1234.5.6.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1345.8.9.el7                RHEL-77-x86_64-updates 
kernel.x86_64                    3.10.0-1579.2.4.el7                RHEL-77-x86_64-updates 

It will show you the installed version and some available versions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.