How to Upgrade An Unsupported OS: An In-depth Checklist

So, you have your shiny new Raspberry Pi, a great idea to use it, and the technical skill to pull it off successfully. It doesn’t matter if it’s as a network print server, a dedicated media center, a retro arcade cabinet or a home automation system. The Pi has you covered.

You configure it to your heart content, adjust every parameter and setting to squeeze out the performance you need, create your best invention. The Pi is foremost an enabling platform, letting you give free rein to your creativity.

And then you let your project run. After the initial set up and configuration, the Pi can be hidden away and forgotten, while it sits in your home network performing its function. And maybe you don’t follow IT security news, or miss a relevant vulnerability report amongst the flood of CVEs, or simply don’t think anyone would target your Pi to exploit any weaknesses. The thing is, hackers love this kind of device because they present an entry point into your network.

The KernelCare Team is proud to announce the latest update to ePortal, its centralized management interface for KernelCare clients. It’s now at version 1.22-1, and it has some new features, namely the easier deployment of the KernelCare client, and some bug fixes.

CloudLinux Enterprise services have been growing steadily for years now. KernelCare, for example, was launched around 6 years ago as a live patching tool for the Linux Kernel. Since then we have added several useful integrations for vulnerability scanners, automation tools and others, and we also released KernelCare+ which adds live patching for OpenSSL and glibc shared libraries.

Last year we also added Extended Lifecycle Support services that let you continue to receive security updates for your systems that are past their original vendor’s End-of-Life date. So if you need more time to migrate to current versions of your distro we can continue to provide patches and updates up to four years past the EOL date.

Our April 2021 blog post is out. We’ve got lots to tell you about, so let’s get started. First up, we highlight UChecker, a tool that checks for vulnerable libraries in your Linux system. Next up is the monthly CVE report. This month, a 20-year-old vulnerability rears its ugly head, and a BPF code vulnerability reveals itself. Next, we’ve updated the KernelCare ePortal. This month we have a guest article about securing your non-commercial IoT devices. We also focus on two informative videos. Last but not least, CentOS AlmaLinux to receive CloudLinux support.

The KernelCare team is proud to announce the release of KernelCare 2.43-2, bringing new features and bug fixes to the enterprise’s live patching tool of choice. This follows the recent update to ePortal, and signals KernelCare’s continued commitment to support and maintain this important and widely used enterprise tool, giving users the confidence to continue to depend on it for their live patching needs.

ePortal is KernelCare Enterprise’s solution for deployments where the machines that need to receive the updates have restricted internet access, serving as a central staging point of delivery for patches, thus reducing exposure of internal resources to outside access.

The KernelCare team is proud to announce the release of ePortal 1.21-1, with many UI improvements and often requested functionality added. One such feature is the ability to control and receive only patches for a specific subset of KernelCare’s supported list of distributions, for example for environments where only one or two different distributions are used. 

Another vulnerability targeting the BPF subsystem has been disclosed publicly in the past few days (CVE-2021-29154). It allows users on a system running non-default configuration of the BPF subsystem to run specially crafted code as a BPF filter and run arbitrary executable code in the kernel context. 

According to vendors, it affects all distributions running kernels up to version 5.11.12. Distribution vendors are starting to deliver patches through their update mechanisms, and KernelCare is also finalizing patches for it’s rebootless patching process to address this issue.

When you see so many vulnerabilities being reported and so many security-related issues being exploited, you may think to yourself “I’m lucky not to be using that package or software, I’m not vulnerable to this”. 

In this month’s update, we highlight CVEs that just won’t die. We’ve also published some critical information regarding live patching the Microsoft Azure IoT Hub with KernelCare IoT integrations. Additionally, we know many still love their old, unsupported distros. The KernelCare team presents an in-depth checklist on how to upgrade an unsupported OS. Keep reading for more details or watch a quick video recap.
.

At what point does an old vulnerability go from being a bug to becoming a feature? That is the question probably going through the mind of many software developers who use libcurl as part of their applications, as a bug was discovered in code committed in August of 2000 to the libcurl code base.