I have server in Google Cloud, running Ubuntu 16.04 with kernel version 4.15.0-1021-gcp.

A fix for some vulnerability fix was recently released. I have question about that: do I need to update my kernel? If so, how should I go about it?


Yes, you need to upgrade your kernel; the TCP SACK vulnerabilities were fixed in version 4.15.0-1034.36~16.04.1 of the Ubuntu kernel image for GCP on 16.04.

To do so,

sudo apt update && sudo apt upgrade

should be sufficient, followed by a reboot. If you only want to upgrade the kernel,

sudo apt update && sudo apt install linux-image-gcp

will upgrade the kernel to the latest ABI, which currently will ensure you get the latest kernel. If you have other kernel-related packages installed, you may need to upgrade them too; in particular, linux-headers-gcp, linux-modules-extra-gcp, linux-tools-gcp.

If you care about keeping your system secure, you should really upgrade all the installed packages anyway; within a single release, great care is taken so that apt upgrade is safe. You’d have to plan for downtime here since the TCP SACK upgrade involves a reboot, so you might as well upgrade everything else; do a test upgrade in your staging environment first.

To verify that the kernel you’re running after rebooting is fixed, the only sure-fire way is to find a reliable exploit, try it against your system and see whether it panics. If it doesn’t, the kernel is fixed; if it does, the kernel isn’t fixed.

(I don’t know whether a fix is available in Livepatch.)


if you have the -generic kernel instead of gcp, its fixed in linux_4.15.0-54.58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.