Critical: Centos 4.x Vulnerability

I should rephrase what I said above: We confirmed that CentOS incorporated the patch by looking in the source RPM file, and after running the -42 kernel for almost two weeks now without any problems, we are confident this problem is fixed in the official CentOS kernel.

Do all the RPMs need to be installed?


[   ] kernel-2.6.9-42.0.2.EL.x86_64.rpm                23-Aug-2006 14:07   12M  
[   ] kernel-devel-2.6.9-42.0.2.EL.x86_64.rpm          23-Aug-2006 14:08  3.6M  
[   ] kernel-doc-2.6.9-42.0.2.EL.noarch.rpm            23-Aug-2006 05:03  2.1M  
[   ] kernel-largesmp-2.6.9-42.0.2.EL.x86_64.rpm       23-Aug-2006 14:12   11M  
[   ] kernel-largesmp-devel-2.6.9-42.0.2.EL.x86_64.rpm 23-Aug-2006 14:14  3.7M  
[   ] kernel-smp-2.6.9-42.0.2.EL.x86_64.rpm            23-Aug-2006 14:18   11M  
[   ] kernel-smp-devel-2.6.9-42.0.2.EL.x86_64.rpm      23-Aug-2006 14:19  3.7M  

Also, will yum auto update this or will it not see it as an update?

For my system i had the following:


[main]
# WARNING! The kernel is excluded from the update list because this system
# contains the nvnet driver. If you wish to update your kernel to a new
# version, you MUST rebuild the nvnet driver against the new kernel BEFORE
# rebooting or you will lose access to your system!
exclude=kernel-*

I have no changed the exclude line to exclude= because the new CentOS has the right nvnet driver.
I did a yum update form SSH and it didn’t find anything. Am I doing something wrong or do I just have to update this manually (RPM) ?

Hi Justec,

No, you definitely do not want to install all those kernels. Type uname -a on your machine, and look for the one that matches. You’ll most likely want either:

kernel-2.6.9-42.0.2.EL.x86_64.rpm -OR-
kernel-smp-2.6.9-42.0.2.EL.x86_64.rpm

I talked to the guys over at Steadfast, and he says he answered your nvnet question via the support ticket you have with them.

Hope that helps,
Socheat

Also, for those who are interested in the nitty-gritty details:

Those of you who are using our patched kernel will not be auto-updated to the official CentOS -42 kernel. This is because when we built our custom kernel, we made the revision number much higher (example, the latest kernel we built is -200). “yum update” will see -200 is higher/“newer” than -42, and thus skip over the -42 kernel.

This is why you must “rpm -ivh --force” install the -42 kernel.

Thanks Socheat.

[QUOTE=IWorx-Socheat;9880]This is because when we built our custom kernel, we made the revision number much higher (example, the latest kernel we built is -200).[/QUOTE] Yeah, Im slow, I didn’t even think about that. You patch your system with the iworx kernel then CentOS release another broken kernel and it auto updates over your Iworx one… doh…

Steadfast told me the nvnet issue isn’t a problem anymore. So I am going to just do this myself, but they are there to back me up if anything happens (Really good guys over there at Steadfast if anyone is looking for a new DC).

So I will leave the yum.conf to no longer exclude the kernel and I should get updates in the future after manually force’n this one.

Thanks again! :smiley:

thats good news i will have a look at that later today.
thanks you

updated to the new kernel no problems,
will see how this one goes as my system used to go down every 5 days before swtching to the custom iworx kernel, thanks for testing socheat and keeping us informed.
cheers

Just a quick note to confirm that the -42 is working great on the machine that I was having severe spinlock problems on. I’ve updated my whole fleet to that kernel and it’s working great.

Awesome nbright! We’ve updated 90% of our internal machines as well and haven’t seen any new issues.

Chris

Same here, works great!

still running great no problems here to :smiley: :smiley: