Live data from Hacker News

Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

openwall.com

21–30 of 78 posts

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#21
post #15

Earlier quoted context omitted.

Is there anyway you can use a different kernel? The kernel is really easily replaceable in other distros. I don't know much about RHEL.

No, you can't do that in RHEL. It would invalidate support.

Seems sad that the modularity of Linux is not allowed due to issues with support. That, in my opinion, is the best part of Linux - which is finding solutions to problems that exists outside of the scope of what is designed by the vendors.

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#22
post #9

I really hate the fact that RHEL updates kernels so slowly. This becomes very painful when your product cannot take advantage of some advanced kernel features just because you have customers running RHEL :(.

Suggest Oracle Linux. Their UEK gets refreshed on a regular basis and it's way closer to upstream. UEK6 just released for OL7 and OL8, based off the 5.4 kernel.

(disclaimer: I work for the Compute team in Oracle Cloud Infrastructure, and work with the OL team regularly on a number of things. It has been one of the more interesting aspects of the job)

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#23
post #20
post #7

Earlier quoted context omitted.

They feel like they know better and do not want all of the fixes that the LTS kernels provide for some crazy reason. I suggest you contact them if you rely on a RHEL kernel to ask them why they do this, it's always seemed crazy. Note, I'm the person who does the LTS kernel releases, maybe they just don't like me :)

It could also be motivated by the fact that it's not entirely wise to base an entire multibillion dollar business around whatever text a non-employee happens to push to a repo you don't control.

Android doesn't seem to mind, they require the LTS updates to be taken for their devices (well, "require" is a strong word, they are pushing harder now than they were in the past, "required" will be happening in the future, hopefully...)

As the number of systems running RHEL is really just a rounding error compared to the number of Android systems out there, maybe it doesn't really matter :)

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#24

Earlier quoted context omitted.

Note that Red Hat, SUSE, and Canonical all don't use them. They maintain their own kernel trees with their modifications. These kernel teams have different priorities: * stable ABI within a timespan (RH, SUSE) * feature backports based on customer demand (all three) * out of tree goop (Canonical) I've also heard from others (though notably, not folks specifically at these companies) that longterm kernels are iffier t…

Seems like even Arch maintains it's own kernel. Not uncommon for distros to do it at all.

Wrong, or at the least misleading.

What do you mean by 'maintain' here? Because Arch is trying to stay on the bleeding edge side of things in a reasonable manner and is rolling release, they almost stay 1:1 with upstream, "maintains its own kernel" makes it sound like they would do some heavy patching and do active maintenance with certain kernel versions, et cetera. You can have a look yourself if you want to https://git.archlinux.org/linux.git/commit/?h=v5.7.5-arch1&i...

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#25

Can someone in the kernel dev space give a longer explanation for this? This looks to me like Red Hat assigning a CVE to something patched a long time ago. Is this just record keeping to label security issues with CVEs or has Red Hat left this unpatched for 17 months? (Or something else?)

Sounds like the latter. They "found" it and requested a CVE, but it was already fixed -- they just hadn't merged that change because they didn't notice it was security-related.

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#26

Your headline's misleading. Red Hat knows it's long been fixed in the LTS kernels, but it still needs patching in the RHEL kernels. Generally speaking, current LTS kernels are not used in older Linux distros.

> Generally speaking, current LTS kernels are not used in older Linux distros

Debian always uses longterm branches. Sometimes Ubuntu, too.

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#27
post #7

Why don't Red Hat et al use the LTS kernels?

They feel like they know better and do not want all of the fixes that the LTS kernels provide for some crazy reason. I suggest you contact them if you rely on a RHEL kernel to ask them why they do this, it's always seemed crazy. Note, I'm the person who does the LTS kernel releases, maybe they just don't like me :)

> They feel like they know better and do not want all of the fixes that the LTS kernels provide for some crazy reason.

It's even crazier; they sometimes backport changes to their kernel that the LTS kernels don't get. We use a custom kernel module that contains a bunch of #if #endif blocks that check the kernel version for stuff that changed. Doesn't work on RedHat since you actually need the branch that's for more recent kernels in some places.

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#28
post #9

I really hate the fact that RHEL updates kernels so slowly. This becomes very painful when your product cannot take advantage of some advanced kernel features just because you have customers running RHEL :(.

If Red Hat (and any of the other major distros) didn't do it, someone else would as a service you could pay for. That lack of updating is exactly why they are used.

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#29

Your headline's misleading. Red Hat knows it's long been fixed in the LTS kernels, but it still needs patching in the RHEL kernels. Generally speaking, current LTS kernels are not used in older Linux distros.

Moderators can of course change the title, I don't think it's misleading and I was not trying to be. I guess 'reports' could be changed into 'finds' and it could be mentioned that it was found 'in its Linux kernel', not sure when the character limit would hit. 'current LTS kernels are not used in older Linux distros' - not sure what your point is with this. They absolutely could have used / can use LTS kernels if the…

"Red Hat finds security issue in Linux Kernel that had been fixed upstream for 17 months"

Re: Red Hat reports security issue in Linux Kernel which was fixed 17 months prior

#30

Why don't Red Hat et al use the LTS kernels?

Note that Red Hat, SUSE, and Canonical all don't use them. They maintain their own kernel trees with their modifications. These kernel teams have different priorities: * stable ABI within a timespan (RH, SUSE) * feature backports based on customer demand (all three) * out of tree goop (Canonical) I've also heard from others (though notably, not folks specifically at these companies) that longterm kernels are iffier t…

Not in my experience. LTS never seems to break any compatibility, even internal kernel structs, function names, etc.
Post reply on HN