I have server in Google Cloud, running Ubuntu 16.04 with kernel version 4.15.0-1021-gcp.
A fix for some vulnerability fix was recently released. I have question about that: do I need to update my kernel? If so, how should I go about it?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Yes, you need to upgrade your kernel; the TCP SACK vulnerabilities were fixed in version 4.15.0-1034.36~16.04.1 of the Ubuntu kernel image for GCP on 16.04.
To do so,
sudo apt update && sudo apt upgrade
should be sufficient, followed by a reboot. If you only want to upgrade the kernel,
sudo apt update && sudo apt install linux-image-gcp
will upgrade the kernel to the latest ABI, which currently will ensure you get the latest kernel. If you have other kernel-related packages installed, you may need to upgrade them too; in particular,
If you care about keeping your system secure, you should really upgrade all the installed packages anyway; within a single release, great care is taken so that
apt upgrade is safe. You’d have to plan for downtime here since the TCP SACK upgrade involves a reboot, so you might as well upgrade everything else; do a test upgrade in your staging environment first.
To verify that the kernel you’re running after rebooting is fixed, the only sure-fire way is to find a reliable exploit, try it against your system and see whether it panics. If it doesn’t, the kernel is fixed; if it does, the kernel isn’t fixed.
(I don’t know whether a fix is available in Livepatch.)
if you have the -generic kernel instead of gcp, its fixed in linux_4.15.0-54.58