Oracle Linux 8 cnspec scan vuln shows non-vulnerabilities about cnspec

[chris-rock]

@schnipschnap Can you look into why that happens? All version comparisons look right to me. I just picked ELSA-2021-4513 https://linux.oracle.com/errata/ELSA-2021-4513.html and the data cnspec shows matches the advisory.

[schnipschnap]

@chris-rock One thing that sticks out to me is that this command:

[root@ip-10-0-101-136 ec2-user]# uname -a
Linux ip-10-0-101-136.ec2.internal 4.18.0-513.11.0.1.el8_9.x86_64 #1 SMP Thu Jan 11 11:30:45 PST 2024 x86_64 x86_64 x86_64 GNU/Linux

claims we are running kernel version 4.18.0-513. However, cnspec claims

9.8 kernel 4.18.0-372.9.1.el8 4.18.0-513.9.1.el8_9 ELSA-2023-7549

we are running 4.18.0-372 which is not true. Also it correctly sees that this is fixed in the latest version 4.18.0-513 which is what we have installed.

[chris-rock]

In linux systems you can install multiple kernel packages at the same point in time. cnspec displays all packages that are installed. 4.18.0-372.9.1.el8 showing up does not mean it is thinking that the kernel is running. That means the kernel package is installed on the system.

You can get a list of all kernel packages via:

packages.where(name == /kernel/)

You can see the installed kernels via:

cnquery> kernel.info.version
kernel.info.version: "6.4.16-linuxkit"

I recommend to purge unused kernels.

[schnipschnap]

Hi @chris-rock this helped. Indeed it was even applicable for packages that can have 2 versions on the system:

e.g. gzip:

[root@ip-10-0-101-136 ec2-user]# yum --showduplicates list gzip
Last metadata expiration check: 0:02:19 ago on Thu 15 Feb 2024 01:12:09 PM GMT.
Installed Packages
gzip.x86_64                                                            1.9-12.el8                                                               @ol8_baseos_latest
gzip.x86_64                                                            1.9-13.el8_5                                                             @ol8_baseos_latest

cnspec vuln will report these outdated installed packages.

However, with bpftool it is different:

This package is installed in the system
bpftool.x86_64 4.18.0-513.11.0.1.el8_9

cnspec asks to install version 5.15.0-201.135.6 as indicated by https://linux.oracle.com/errata/ELSA-2023-13043.html

This version seems to be missing from the Oracle linux repository:

[root@ip-10-0-101-136 ec2-user]# yum remove bpftool
Dependencies resolved.
==================================================================================================================================================================
 Package                         Architecture                   Version                                          Repository                                  Size
==================================================================================================================================================================
Removing:
 bpftool                         x86_64                         4.18.0-513.11.0.1.el8_9                          @ol8_baseos_latest                         2.9 M

Transaction Summary
==================================================================================================================================================================
Remove  1 Package

Freed space: 2.9 M
Is this ok [y/N]: y
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                          1/1 
  Erasing          : bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 
  Running scriptlet: bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 
  Verifying        : bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 

Removed:
  bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                                          

Complete!
[root@ip-10-0-101-136 ec2-user]# yum update
Last metadata expiration check: 0:08:34 ago on Thu 15 Feb 2024 01:12:09 PM GMT.
Dependencies resolved.
Nothing to do.
Complete!

[root@ip-10-0-101-136 ec2-user]# 
[root@ip-10-0-101-136 ec2-user]# 
[root@ip-10-0-101-136 ec2-user]# yum install bpftool
Last metadata expiration check: 0:08:41 ago on Thu 15 Feb 2024 01:12:09 PM GMT.
Dependencies resolved.
==================================================================================================================================================================
 Package                         Architecture                   Version                                           Repository                                 Size
==================================================================================================================================================================
Installing:
 bpftool                         x86_64                         4.18.0-513.11.0.1.el8_9                           ol8_baseos_latest                          11 M

Transaction Summary
==================================================================================================================================================================
Install  1 Package

Total download size: 11 M
Installed size: 2.9 M
Is this ok [y/N]: y
Downloading Packages:
bpftool-4.18.0-513.11.0.1.el8_9.x86_64.rpm                                                                                         36 MB/s |  11 MB     00:00    
------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                              35 MB/s |  11 MB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                          1/1 
  Installing       : bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 
  Running scriptlet: bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 
  Verifying        : bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                   1/1 

Installed:
  bpftool-4.18.0-513.11.0.1.el8_9.x86_64                                                                                                                          

Complete!
[root@ip-10-0-101-136 ec2-user]# 

This is an Oracle Linux issue - closing this

[chris-rock]

Oracle lists various package repositories in https://yum.oracle.com/oracle-linux-8.html, can you check if the package is in their Test and Development repos?

[chris-rock]

Can you also share how you purged the packages so that users who encounter the issue know how to resolve the issue quickly?

[schnipschnap]

How to remove old kernels manually:

1. List all kernels:

rpm -q kernel
rpm -q kernel-code
rpm -q kernel-modules

2. Remove all old kernel packages using yum remove <package>

Example yum remove kernel-core-4.18.0-372.9.1.el8.x86_64 kernel-core-4.18.0-477.10.1.el8_8.x86_64

How to remove kernels automatically:

package-cleanup --oldkernels --count=1

How to remove old installed packages:

Find the outdated package version using yum --showduplicates list <package>

Example for gzip:

[root@ip-10-0-101-136 ec2-user]# yum --showduplicates list gzip
Last metadata expiration check: 0:34:21 ago on Thu 15 Feb 2024 01:12:09 PM GMT.
Installed Packages
gzip.x86_64                                                            1.9-12.el8                                                               @ol8_baseos_latest
gzip.x86_64                                                            1.9-13.el8_5                                                             @ol8_baseos_latest

Removal of outdated package:

yum remove gzip.x86_64-1.9-12.el8

[schnipschnap]

As of now there are no packages even in the developer repo: https://yum.oracle.com/repo/OracleLinux/OL8/baseos/developer/x86_64/index.html

bpftool is at [bpftool-4.18.0-477.el8.x86_64.rpm] last update April 6 2023

It can be found for Oracle Linux 9 though here: https://oraclelinux.pkgs.org/9/ol9-baseos-latest-aarch64/bpftool-5.15.0-201.135.6.el9uek.aarch64.rpm.html

[chris-rock]

I see potential two problems with bpftool:

9.8    bpftool         4.18.0-513.11.0.1.el8_9  5.15.0-201.135.6.el9uek                 ELSA-2023-13043

The comparison is not correct, since we should not compare el8_9 to el9uek.

• Do we need to detect if the uek kernel is running?
• From the advisory it looks like bpftool-5.15.0-201.135.6.el8uek.x86_64.rpm should be the recommended version for OEL8