News for hackers. Stuff that matters.

A comment on Google discloses CentOS Linux kernel vulnerabilities citing failure to fix. Parent comment

Re:Google discloses CentOS Linux kernel vulnerabilities citi... by kevin_thibedeau on Friday March 24, 2023 @12:41PM (#35291722)
Nothing prevents you from running the latest kernel. The kernel build scripts can even generate .deb and .rpm directly so it coexists nicely with the package manager, though even that isn't strictly necessary.
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by aaomidi on Friday March 24, 2023 @12:54PM (#35291934)
Other than the constant restarts necessary. It’s not that but it does get old fast.
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by calvinmorrison on Friday March 24, 2023 @02:03PM (#35293139)
kpatch has been around for like a decade from Red Hat, I think suse has something similar, ubuntu has a Livepatch service.
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by msh on Friday March 24, 2023 @02:44PM (#35293687)
Who cares about a few reboots? You can reboot a workstation overnight and if you have a single point of failure in your production system the reboot ain't the problem.
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by yjftsjthsd-h on Friday March 24, 2023 @03:47PM (#35294467)
> You can reboot a workstation overnight

That depends entirely on how well your state serializes to disk and restores. If nothing else, I occasionally make the mistake of getting a setup going that would just be a pain to recreate in terms of getting everything open again (too many windows open in a specific arrangement).

[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by hollerith on Friday March 24, 2023 @03:00PM (#35293889)
Nothing prevents you from running the latest kernel, but the project is introducing new bugs with security implications all the time even as it is eradicating old bugs, which is why one guide recommends an LTS kernel as the better of two bad options (the other option's being a stable kernel):

https://madaidans-insecurities.github.io/guides/linux-harden...

[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by fooker on Friday March 24, 2023 @07:12PM (#35296922)
Newer bugs are get fixed faster and are less likely to be exploited compared to older bugs.
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by CoolGuySteve on Friday March 24, 2023 @04:13PM (#35294803)
Ubuntu LTS has a package called linux-hwe that backports the latest Ubuntu kernel to the last LTS release. I find it's a good compromise between maintaining a mainline kernel and using an ancient one. And since the hwe kernel is provided by Ubuntu and used in its release, it's been tested by thousands of users and updating it is a breeze.

My only complaint is that I wished it went back 2 LTS releases. For example, the current project I'm working on settled on 20.04 and there are no more new hwe kernels being released for it despite the rest of the userland receiving updates.

[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by archontes on Friday March 24, 2023 @04:40PM (#35295133)
Nothing other than breaking my graphics drivers. Who needs a monitor?
[ Parent | on HN ]
Re:Google discloses CentOS Linux kernel vulnerabilities citi... by invalidator on Friday March 24, 2023 @05:04PM (#35295488)
A few years ago we couldn't upgrade the kernel because XFS had a regression. Our choices were: revert the XFS changes in the newer kernel; backport security fixes to the version we were already using.

We went with the latter because our minimal attack surface made it unlikely that we'd need to backport many fixes, but it was always looming.

[ Parent | on HN ]