1

As per Exclude or display vulnerabilities for non-running Linux kernels :

It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on all Linux kernels.

Linux distributions support the parallel installation of multiple kernel versions. When installing a new kernel, a boot entry and an initrd are automatically created, so no further manual configuration is needed. Do I really need then to be concerned about vulnerabilities discovered for older installed kernels (which are in fact not used to boot the system)? Is there any risk involved? I mean, sure one could probably argue that once someone gets access to the server he/she could boot into an older (more vulnerable if you will) installed kernel version but that would require root privileges in the first place.

1 Answer 1

1

Do I really need then to be concerned about vulnerabilities discovered for older installed kernels (which are in fact not used to boot the system)?

A non-running kernel with vulnerabilities does not pose a threat to your system; the kernel must be booted for those vulnerabilities to become an issue. So if you truly never boot the older kernels, you are not exposed to the vulnerabilities. That being said, ...

Is there any risk involved?

From Qualys' point of view, they cannot know if the machine is rebooted into a vulnerable kernel at times, they simply know that it is possible. And so they assume the worst and include those vulnerabilities.

The most secure option would be to remove the old, vulnerable kernels.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .