As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous executables like malware. (research and analytics)
Two days ago, after several high severity security vulnerabilities (DSA-5191-1) have been discovered and patched in the latest kernel, I noticed that one of the machines I use to handle potentially malicious/dangerous executables (in virtual machines) was running the
5.10.0-13 kernel (at the time of writing,
5.10.0-16 is the latest) due to the fact that the
linux-image-5.10.0-13-amd64 package was directly installed without the
Upon investigating I found out that this was because of a mistake that happened while installing the system and that the system was running on
5.10.0-13 since its install. (A few months ago, at that time the
5.10.0-13 kernel was the latest)
unattended-upgrades running and additionally checked daily and before every use for (security-)updates.
I'm using rkhunter and was running it before and after every update, as well as before every use of the machine.
linux-image-5.10.0-13-amd64 was at least up to date at all times.
After discovering this issue I immediately installed the linux-image-amd64 package (therefore the latest kernel) and purged the old one after a reboot.
- OS: Debian 11 Bullseye
- Arch: AMD64 (x86_64)
- CPU: Intel
- Is virtualized itself: no
- Virtualization used on the system: yes (KVM + QEMU; x86_64 too)
- What are the exact differences between the "number after dash" versions? I don't mean that in a "changelog-way" but more like "what makes the number go up?" (e.g.
-16) Are these just something like different "flavours" or actually versions that deprecate one another? I have read about ABI Versioning but the exact meaning of different numbers after the dash was never explained.
- Is the
5.10.0-13kernel still to be considered as secure and was my system at any point in time vulnerable to known (and in the latest kernel fixed) security vulnerabilities because of it running on the
5.10.0-13kernel instead of
- Is the
5.10.0-13kernel affected by DSA-5191-1? (I looked at the CVEs and the DSA for myself but the
5.10.0-13kernel-package wasn't even in the list of packages.)
- I use virtual machines on this system to handle potentially malicious/dangerous files. (as mentioned above) Could using the "wrong" kernel have weakened the security of the virtualization?
- Overall, should I be in any way concerned or think of my system as potentially compromised because of this? Was this misconfiguration in any way and at any time posing any risk?