2

It came to our notice that glibc needs to be upgraded from the current version 2.2 to the latest as per the release 5/6/7.

My Question is that do I need to reboot the system, because we are having more then 7000 server in our environment, it will be hard to do reboot the system.

After updating glibc it is not vulnerable, So why does the application/server needs to be restarted

6

I answered most questions in this thread here about the ghost vulnerability.

In short no, rebooting the system isn't 'required' but because so many applications/system utilities use glibc, you will have to make sure you restart every one of them before the patch takes effect. This is why it is 'recommended' that you just restart the environment.

My thread shows you how you can identify which applications use glibc that will need to be restarted and how to test for the vulnerability before and after to see if you are still affected. The glibc test might show not vulnerable after patching but you still need to make sure you restart all those applications because they load glibc into memory and those versions of glibc in memory are still vulnerable to the exploit. So you aren't safe yet.

  • @Chrisii no problem. Glad it helps. – devnull Feb 2 '15 at 12:37
1

Matasano Security has written a great article about the Ghost vulnerability. It states that all processes that use the glibc library require a restart so I suspect that you at least have to restart all services so they use the new library.

Fix

If your distribution has patches available, install those patches. Otherwise:

  • Update to glibc 2.18 or newer
  • Restart all processes that load the glibc library
  • Issue new binaries for software statically linked against a vulnerable version of the glibc library.

Redhat recommends a complete reboot but also provide the command to find all services that use libc

Reboot the system or restart all affected services:

Because this vulnerability affects a large amount of applications on the system, the safest and recommended way to assure every application uses the updated glibc packages is to restart the system.

In case you are unable to restart the entire system, execute the following command to list all services and binaries using glibc on your system.

$ lsof +c 15 | grep libc- | awk '{print $1}' | sort -u

From the resulting list, identify the public-facing services and restart them. While this process may work as a temporary workaround, it is not supported by Red Hat and, should a problem arise, you will be requested to reboot the system before any troubleshooting begins.

  • That command isn't a good way of locating processes using the old libc. It lists processes using the new version as well, and for libc that means basically every process. – Gilles Feb 2 '15 at 21:26
  • @Gilles, obviously you have to issue the command before upgrading the libc library. Redirect the output to a file for later reference. Upgrade libc and then you refer back to the file and restart all the processes that depend on libc. You're right that libc is used by a lot of applications which dynamically link against it. It is much more feasible to completely restart the machine however since OP was asking if it's possible without restarting I thought it might be a good idea to at least mention the option. – Chrisii Feb 2 '15 at 21:48
  • @Gilles, I hope I didn't offend you. If I did, I am sorry that I made it sound so offensive. – Chrisii Feb 2 '15 at 21:53
  • I am thankful to both of you Gilles & Chrisii. I have got more details on this. You both explained in very depth. – Mongrel Feb 3 '15 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.