Kernelcare and symlink ownership attacks
My Security Advisor reports -
KernelCare is installed and current running kernel version is up to date: 5.14.0-687.38.1.el9_8.x86_64
But it also says -
Kernel does not support the prevention of symlink ownership attacks.
You do not appear to have any symlink protection enabled through a properly patched kernel on this server, which provides additional protections beyond those solutions employed in userland.
Does this mean that although I've installed the kernelcare free patchset, they haven't released a patch for the kernel that I'm running?
If so, would purchasing the extra patchset make any difference, or would I still have to wait until the patch is released?
-
See if this article is helpful:
0 -
That seems to require a license. I get this error when I run the first command -
Unauthorized: https://patches.kernelcare.com/patches/K20260817_0013/a902802312f54f8c560c8c8f890120c0ae8ee08e/1/kpatch.extra.bin0 -
"Does this mean that although I've installed the kernelcare free patchset, they haven't released a patch for the kernel that I'm running?"
This is almost certainly the answer. The free patch set should include the fix, but you an always check over at https://patches.kernelcare.com/ to see if your kernel is listed.
I do see the kernel you mention listed there when I search. although it was just added yesterday, so maybe it was added since you created this post.
0 -
Thank you. I'll keep an eye on it and see if the new patch set gets installed.
1
Please sign in to leave a comment.
Comments
4 comments