On Mar 4, 2018 3:21 PM, Ruben Safir <ruben@mrbrklyn.com> wrote:
On 03/04/2018 01:31 PM, valdis.kletnieks@vt.edu wrote:
Note that saying "The CPU isn't vulnerable to Meltdown/Spectre, therefor the 4.1 kernel is OK" is *incredibly* wrong.
For the record, since 4.1 came out, there's been at *least* a dozen security issues in the Linux kernel that have been a *lot* scarier for security professionals than the Meltdown/Spectre issue. That only got any news coverage because it was an actual hardware design flaw that was believed to be difficult to easily fix with software changes...
By this standard, it is necessary to update the kernel and reboot nearly every week. Is that right?
You can kexec into the newer kernel to avoid rebooting if you absolutely must but yeah the best practice is to keep your system up to date and that requires some disruption of service. There's also kernel live patching which would allow you to patch the kernel without rebooting but I don't know how well supported that option is.
-- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Regards, Alex