Alibaba Cloud Linux:Operations related to kernel hotfixes

From the CVE announcement platform

The CVE announcement platform lists every released hotfix with its details and download link.

1. Open the security advisories page for your distribution:

   • Alibaba Cloud Linux 2.1903: https://mirrors.aliyun.com/alinux/cve/alinux2.xml

   • Alibaba Cloud Linux 3: https://mirrors.aliyun.com/alinux/3/cve/alinux3.xml

2. Click Advisory ID to sort the list. Advisories with IDs starting with HOTFIX are kernel hotfixes.

   

   Each advisory contains the following columns:

   Column	Description
   Affected packages	The hotfix package name, prefixed by kernel-hotfix- and suffixed by the OS minor version number. Use this to confirm whether the hotfix applies to your system.
   Advisory ID	The release identifier. Click it to view hotfix details and download the RPM package.
   CVE ID(s)	The CVE identifier being fixed. Empty for Bugfix hotfixes.

3. Click the Advisory ID to open the hotfix details page.

   

   The page shows the RPM package name in this format:

   kernel-hotfix-{hotfix_id}-{minor_version}-{hotfix_version}-{timestamp}.{major_version}.{architecture}.rpm

   For example, kernel-hotfix-5928799-5.al8.x86_64 1.0-20210720165816.al8 breaks down as:

   Field	Value	Meaning
   Hotfix ID	5928799	Unique identifier for this hotfix
   Minor version	5.al8	Applies to Alibaba Cloud Linux 3 kernels with minor version 5.al8
   Hotfix version	1.0	Version of the RPM package
   Timestamp	20210720165816	Created at 16:58:16 on July 20, 2021
   Major version	al8	Alibaba Cloud Linux 3 (all AL3 systems use al8; AL2 systems use al7)
   Architecture	x86_64	System architecture

   The timestamp field may show an invalid value for some earlier hotfix versions.

From a YUM repository

Run sudo yum list | grep "kernel-hotfix" to see all available hotfixes. This is covered in the installation steps below.

Prerequisites

Before you begin, ensure that you have:

• SSH access to the Alibaba Cloud Linux ECS instance. For connection methods, see Connection methods.

• sudo privileges on the instance

Procedure

1. Install the kpatch utility:

   sudo yum -y install kpatch

2. Check your running kernel version:

   sudo uname -r

   Example output:

   5.10.23-5.al8.x86_64

   The minor version number is the segment after the first hyphen — 5.al8 in this example. Only hotfixes that match this value apply to your system.

3. List available hotfixes for your kernel:

   sudo yum list | grep "kernel-hotfix" | grep "<Minor version number of the operating system>"

   For example, if your minor version number is 5.al8, run:

   sudo yum list | grep "kernel-hotfix" | grep "5.al8"

   Example output:

   kernel-hotfix-5928799-5.al8.x86_64    1.0-20210720165816.al8    alinux3-plus
   kernel-hotfix-5956925-5.al8.x86_64    1.0-20210726171200.al8    alinux3-plus

4. Install the hotfix. Replace <package-name> with the full package name from the previous step:

   sudo yum -y install <package-name>

   For example:

   sudo yum -y install kernel-hotfix-5928799-5.al8.x86_64

   Do not append .rpm to the package name when installing via yum.

Verify the installation

Run the following command to confirm the hotfix is loaded and active:

sudo kpatch list

Expected output:

Loaded patch modules:
kpatch_5928799 [enabled]

Installed patch modules:
kpatch_5928799 (5.10.23-5.al8.x86_64)

[enabled] under Loaded patch modules confirms the hotfix is applied to the running kernel.

Prerequisites

Before you begin, ensure that you have:

• sudo privileges on the instance

Procedure

1. List installed hotfixes:

   sudo yum list installed | grep kernel-hotfix

   Example output:

   kernel-hotfix-5928799-5.al8.x86_64    1.0-20210720165816.al8    @alinux3-plus

2. Remove the faulty hotfix. Replace <package-name> with the package name from the previous step:

   sudo yum -y remove <package-name>

   For example:

   sudo yum -y remove kernel-hotfix-5928799-5.al8.x86_64

Verify the removal

Confirm the hotfix has been removed:

sudo kpatch list

Expected output:

Loaded patch modules:

Installed patch modules:

Both sections are empty, indicating the hotfix is no longer installed or in effect.

Prerequisites

Before you begin, ensure that you have:

• sudo privileges on the instance

Procedure

1. Confirm the kpatch service is currently enabled:

   sudo systemctl is-enabled kpatch.service

   The output enabled confirms the service is active.

2. Disable the kpatch service:

   sudo systemctl disable kpatch.service

   Expected output:

   Removed symlink /etc/systemd/system/multi-user.target.wants/kpatch.service.

Verify the service is disabled

sudo systemctl status kpatch.service

The output confirms the service is disabled when you see disabled in the Loaded: line:

kpatch.service - "Apply kpatch kernel patches"
   Loaded: loaded (/usr/lib/systemd/system/kpatch.service; disabled; vendor preset: disabled)

To re-enable the kpatch service and restore automatic hotfix loading on restart, run sudo systemctl enable kpatch.service.