A while back I started an embedded project using the 3.2.10 kernel. Now the project should go into production and the stable kernel is 3.2.16. I would prefer not to upgrade anything to avoid incompatibilities etc. but if serious security vulnerabilities has been plugged from 3.2.10 to 3.2.16 I have to do so.

Where can I find out if security vulnerabilities has been plugged between the two versions? I have not been able to find the answer in obvious places like kernel.org.


One place to look is MITRE's Common Vulnerabilities and Exposures. The search page is here. I did a search on "linux kernel" and found a bunch, but only one in 2012, which is when 3.2 would have come out, right? I don't follow Linux Kernel development closely, but I'm given to understand that the Linux Kernel developers have an attitude that considers most "security holes" as reliability bugs or something like that.


Most kernel security issues can only be exploited by loading strange or seldom used modules. (this is true for the last two years where I have been watching Linux Kernel CVEs closely).

Example modules:

  • IPX
  • AppleTalk
  • IPv6 (this is not strange, but has MANY features)
  • USB/ISDN-card

So the easiest way to be on the safe side here is to disable hot-plugging and/or automatic module loading. This should be easy on an embedded system.

Apart from that you are never sure with newer features - most CVE were centered around new modules that brought new functionality.

GLibC is another candidate for serious security problems. So if your embedded system allows a shell the attacker will become root - sooner or later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.