1

Just noticed that CentOS 7 is using Kernel 3.10 which was maintained from August 2013 to November 2017 so it's basically EOL.

I know that CentOS doesn't update Kernel versions between minor CentOS releases which is the reason for it having this old and now unsupported Kernel.

How does this work in general? What if a vulnerability or a serious bug is found?

When the Kernel was still supported, it would have been fixed by the Kernel maintainers and then I guess CentOS could have backported it.

Now that the Kernel is EOL doesn't this leave all the Enterprises using CentOS 7 kind of screwed?

Could someone explain this?

2

CentOS backports security patches to it's products throughout it's maintenance lifecycle. CentOS 7 will be supported for maintenance updates through June 2024, which means they will continue security patches until then. Do not confuse upstream kernel support with the support from the distribution maintainers.

Fore more info, see this: https://wiki.centos.org/About/Product

EDIT: here is a (truncated) list of security patches in the most recent CentOS 7 kernel package:

$ rpm -qip --changelog kernel-3.10.0-862.11.6.el7.x86_64.rpm | grep -E '(^\*|CVE)' | grep -B1 CVE
* Fri Aug 10 2018 Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.6.el7]
- [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
* Thu Aug 09 2018 Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.11.5.el7]
- [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
* Tue Aug 07 2018 Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.4.el7]
- [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}
* Mon Aug 06 2018 Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.3.el7]
- [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] net: add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}
<SNIP>

There are many, many more patched that have been introduced since CentOS 7 was originally introduced. This is just a small sample of the most recent ones.

  • What about if bug or vulnerability is found in the Kernel needs to be patched? I checked one of our CentOS7 servers and it is still running the same Kernel version as when CentOS7 was initially released. Does this means that there just wasn't anything yet worth backporting? Also in the case when there is such a need, will CentOS do its own release of the Kernel with the issue fixed or will they provide the fix upstream to the Kernel maintainers? – user Sep 21 '18 at 7:38
  • 1
    There have been many kernel updates since CentOS 7 was first released. The initial release in July 2014 was kernel-3.10.0-123.el7.x86_64. The most recent CentOS 7 kernel was released in August 2018, and is version kernel-3.10.0-862.11.6.el7.x86_64. There have been many things backported between those two times. You just need to look at the details of the latest kernel packages that CentOS provides to see the change logs. – guzzijason Sep 21 '18 at 16:17
  • I just updated my answer to give a sample of security fixes that have been integrated into the most recent CentOS 7 kernel. – guzzijason Sep 21 '18 at 16:29
  • I don't want to submit a full question; do you know if RedHat does the backporting for RHEL and CentOS assigned people apply them to CentOS, or if CentOS people write the patches especially for CentOS? – axus Sep 21 '18 at 17:33
  • My understanding is that patches flow in to RHEL first, and then they are incorporated into CentOS after. I wouldn't expect many differences between the RHEL and CentOS versions - probably just branding cleanup mostly. – guzzijason Sep 21 '18 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.