How To Patch Running Linux Kernel Source Tree

by on February 12, 2008 · 4 comments· LAST UPDATED February 14, 2008

in , ,

Yesterday, I wrote about a serious Linux kernel bug and fix. However, few readers like to know about patching running Linux kernel. Patching production kernel is a risky business. Following procedure will help you to fix the problem.

Step # 1: Make sure your product is affected

First find out if your product is affected by reported exploit. For example, vmsplice() but only affects RHEL 5.x but RHEL 4.x,3.x, and 2.1.x are not affected at all. You can always obtain this information by visiting vendors bug reporting system called bugzilla. Also make sure bug affects your architectures. For example, a bug may only affect 64 bit or 32 bit platform.

Step # 2: Apply patch

You better apply and test patch in a test environment. Please note that some vendors such as Redhat and Suse modifies or backports kernel. So it is good idea to apply patch to their kernel source code tree. Otherwise you can always grab and apply patch to latest kernel version.

Step # 3: How do I apply kernel patch?

WARNING! These instructions require having the skills of a sysadmin. Personally, I avoid recompiling any kernel unless absolutely necessary. Most our production boxes (over 1400+) are powered by mix of RHEL 4 and 5. Wrong kernel option can disable hardware or may not boot system at all. If you don't understand the internal kernel dependencies don't try this on a production box.

Change directory to your kernel source code:
# cd linux-2.6.xx.yy
Download and save patch file as fix.vmsplice.exploit.patch:
# cat fix.vmsplice.exploit.patch
Output:

--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1234,7 +1234,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
                if (unlikely(!len))
                        break;
                error = -EFAULT;
-               if (unlikely(!base))
+               if (!access_ok(VERIFY_READ, base, len))
                        break;
                /*

Now apply patch using patch command, enter:
# patch < fix.vmsplice.exploit.patch -p1
Now recompile and install Linux kernel.

I hope this quick and dirty guide will save someones time. On a related note Erek has unofficial patched RPMs for CentOS / RHEL distros.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 4 comments… read them below or add one }

1 Lubomir Host February 12, 2008 at 8:08 pm

It is possible also patch running linux kernel and fix vulnerability. Here is the solution:

http://platon.sk/article.php?vmsplice-vulnerability-fast-fix

Reply

2 David Douthitt February 14, 2008 at 12:51 am

I would like to suggest that your description does not tell how to patch a running kernel (as the title states). It tells how to patch the source code for a specified kernel.

To patch the running kernel would be interesting, require the use of debuggers against /dev/kmem, and would probably not be useful in most situations.

Reply

3 nixCraft February 14, 2008 at 6:49 am

Title has been updated

Reply

4 sankar December 15, 2009 at 10:30 am

hi
here i like to know something about the kernel patches and how to rebuild the kernel.
Now i am running RHEL 5.2 and Centos 5.2. I like to upgrade 5.4 both systems. so how to download the new kernel patches and how to apply that.
Also in fulture the system will be affect in kernel problem. how can I rebuild?

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , ,

Previous post:

Next post: