CVE-2016-5195: Dirty COW - Privilege escalation kernel vulnerability

A reboot indeed resolved this. When I do a "uname -v" now after the reboot I now get:

#1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19)

At a glance, it looks like either the update is installed already but just not being used; or you aren't getting updated package information for some weird reason.

If rebooting doesn't make any difference, can you please give me the output of:

apt-get update
apt-get install linux-image-amd64

Hello,

I tried to apply the security updates to patch the CVE-2016-5195 vulnerability but I did not appear to work. I have the Wordpress appliance 14.0 and the result of "uname -v"  is  "#1 SMP Debian 3.16.7-ckt25-2+deb8u3 (2016-07-02)".  I tried the commands you noted here:  /docs/automatic-security-updates

I ran the command:

turnkey-install-security-updates

and the result ultimately was:

"0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."

The uname command gave the same result as above.

I also ran:

/usr/sbin/cron-apt

again nothing happened and I have the uname was the same.

I have left the machine running so I guess the 4AM auto update you guys have in there must have failed too.

Any suggestions as to what I can try now?
 

Cool

Out of interest, are you using LVM in your install? FWIW it's default on OVA/VM builds and optional on ISO install. It seems to be a factor in that other thread.

Long story short, here's something you could try:

See what device your boot directory/partition is on. Check fdisk and look for the entry that has the boot flag set (i.e. has a '*' under 'Boot') e.g.:

[...]
Device     Boot  Start      End  Sectors  Size Id Type
/dev/sda1  *      2048   499711   497664  243M 83 Linux
[...]

grub-install /dev/sda

ls /boot/grub/grub.cfg

Please let me know if you continue to have issues and/or any of that doesn't make sense.

As an update > a shutdown and reboot didn't help.

I've run some other tests though and the system is reported as safe.   

Weird.   When I get a chance I'll try a  build using the latest iso.  

I'll reboot it again when I get a chance.

So you have the right kernel installed, it's just your system isn't using it.

Normally a reboot should resolve that. But you said that you had already rebooted right?!

Maybe for some reason your server was a bit slow to update, so when you rebooted before the new kernel hadn't installed. But at some point since it has installed the update and just needs a reboot now!?

Output from : apt-cache policy linux-image-3.16.0-4-amd64

linux-image-3.16.0-4-amd64:
  Installed: 3.16.36-1+deb8u2
  Candidate: 3.16.36-1+deb8u2
  Version table:
 *** 3.16.36-1+deb8u2 0
        500 http://security.debian.org/ jessie/updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.16.36-1+deb8u1 0
        500 http://http.debian.net/debian/ jessie/main amd64 Packages

So that in fact looks good.  Strange then that uname -v should report something else.

This is stretching my linux experience, so I'm guessing but is it possible apt thinks its install but in fact it hasn't been applied properly ?

As the apt-cache looks good I have followed up on the sources - but the lists look ok as best I can tell.

Thanks for the support on this.  

apt-cache policy linux-image-3.16.0-4-amd64

The one we use by default, should redirect you to the best mirror. However, in your case, perhaps it's not for some reason? So perhaps try explicitly using one of the Debian mirrors (don't change the TurnKey mirror, just the entries that are http.debian.org).

To do that have a look at your apt sources file(s). The default top level sources file is /etc/apt/sources.list but by default in TurnKey we leave that empty and instead it is configured in 2 separate files within /etc/apt/sources.list.d/. FWIW apt will read any file within that directory which has a .list file extension. By default TurnKey provides a general sources.list (/etc/apt/sources.list.d/sources.list) and a security sources list (/etc/apt/sources.list.d/security-sources.list). Initially just adjust the general list. But once you have resolved the immediate issue, I urge you to also update the security list (that's what the auto secupdates uses).

Obviously you'll need to run "apt-get update" once you've updated your sources.list. I also recommend that initially you just check for the versions available (i.e. apt-cache policy).

As for your question re the "Ign"s, TBH I'm not 100% sure, but AFAIK it is as you say; a warning. I see them lots on my (Debian) desktop as I'm Australian and use the en_AU locale. But as "Australian English" (at least in more formal written form) is essentially a subset of British and US English, nobody makes any specific translations for en_AU so when apt-get update checks for Australians translations they always return "Ign".

apt-get

Get:1 http://security.debian.org jessie/updates InRelease [63.1 kB]
Get:2 http://security.debian.org jessie/updates/main amd64 Packages [328 kB]
Ign http://http.debian.net jessie InRelease
Ign http://archive.turnkeylinux.org jessie-security InRelease
Get:3 http://security.debian.org jessie/updates/contrib amd64 Packages [2506 B]
Get:4 http://security.debian.org jessie/updates/contrib Translation-en [1211 B]
Hit http://http.debian.net jessie Release.gpg
Get:5 http://security.debian.org jessie/updates/main Translation-en [173 kB]
Ign http://archive.turnkeylinux.org jessie InRelease
Hit http://http.debian.net jessie Release
Hit http://archive.turnkeylinux.org jessie-security Release.gpg
Hit http://http.debian.net jessie/main amd64 Packages
Hit http://http.debian.net jessie/contrib amd64 Packages
Hit http://archive.turnkeylinux.org jessie Release.gpg
Hit http://http.debian.net jessie/contrib Translation-en
Hit http://http.debian.net jessie/main Translation-en
Hit http://archive.turnkeylinux.org jessie-security Release
Hit http://archive.turnkeylinux.org jessie Release
Hit http://archive.turnkeylinux.org jessie-security/main amd64 Packages
Hit http://archive.turnkeylinux.org jessie/main amd64 Packages
Ign http://archive.turnkeylinux.org jessie-security/main Translation-en
Ign http://archive.turnkeylinux.org jessie/main Translation-en
Fetched 568 kB in 3s (156 kB/s)
Reading package lists... Done

and apt-cache

linux-image-amd64:
  Installed: 3.16+63
  Candidate: 3.16+63
  Version table:
 *** 3.16+63 0
        500 http://http.debian.net/debian/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

I noticed there are a few Ign's on apt-get - I'd always treated that as a warning - is that an issue?

That does seem really weird and TBH I don't understand. Are you getting any errors or warnings when you run apt-get update?

Also what is the output from:

apt-cache policy linux-image-amd64

Would appreciate some help on this .. got a turnkey nginx server (turnkey-nginx-php-fastcgi-14.0-jessie-amd64)

uname -v returns:

#1 SMP Debian 3.16.7-ckt11-1+deb8u5 (2015-10-09)

Have also run 

turnkey-install-security-updates

And 

/usr/sbin/cron-apt

And rebooted -but still showing the older kernel.

The following was also no help - it all reports up to date.

apt-get update && apt-get upgrade && apt-get dist-upgrade

This also indicates nothing to update:

apt-get install linux-image-amd64

output is:

Reading package lists... Done
Building dependency tree
Reading state information... Done
linux-image-amd64 is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Confused ???   Scott