LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
Reload this Page [SOLVED] Kernel upgrade for Slackware 14.2 (security and bug fixes)
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 11-07-2019, 11:52 PM   #1
hitest
Guru
 
Registered: Mar 2004
Location: Canada
Distribution: Void, Slackware
Posts: 7,342

Rep: Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746
Kernel upgrade for Slackware 14.2 (security and bug fixes)

Code:
Thu Nov  7 21:35:45 UTC 2019
patches/packages/linux-4.4.199/*:  Upgraded.
  These updates fix various bugs and security issues.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 4.4.191:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3900
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15118
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10906
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10905
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10638
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15117
    Fixed in 4.4.193:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14835
    Fixed in 4.4.194:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14816
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14814
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15505
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14821
    Fixed in 4.4.195:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17053
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17052
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17056
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17055
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17054
    Fixed in 4.4.196:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2215
    Fixed in 4.4.197:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16746
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20976
    Fixed in 4.4.198:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17075
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17133
    Fixed in 4.4.199:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15098
  (* Security fix *)
http://slackware.osuosl.org/slackwar.../ChangeLog.txt
 
Old 11-08-2019, 04:53 PM   #2
ChuangTzu
Senior Member
 
Registered: May 2015
Location: Where ever needed
Distribution: Slackware/Salix while testing others
Posts: 1,718

Rep: Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857Reputation: 1857
Thanks for the heads up hitest...And thank you PV...
 
1 members found this post helpful.
Old 11-08-2019, 05:31 PM   #3
twy
Member
 
Registered: Jun 2004
Distribution: Slackware64
Posts: 99

Rep: Reputation: Disabled
With these kernel 4.4.199 updates to slackware64-14.2, the kernel-firmware patch seems to be missing. When using slackpkg, this causes my system to prompt to revert back to kernel-firmware from 2016 in the original release.

edit: solved. packages are there now, thanks.
Last edited by twy; 11-09-2019 at 04:06 AM. Reason: solved
 
Old 11-08-2019, 06:00 PM   #4
Didier Spaier
LQ Addict
 
Registered: Nov 2008
Location: Paris, France
Distribution: Slint64-15.0
Posts: 11,055

Rep: Reputation: Disabled
Quote:
Originally Posted by twy View Post
With these kernel 4.4.199 updates to slackware64-14.2, the kernel-firmware patch seems to be missing. When using slackpkg, this causes my system to prompt to revert back to kernel-firmware from 2016 in the original release.
The right way to update is to follow these instructions: http://www.slackware.com/lists/archi...ecurity.756390

The kernel-firmware package is not upgraded at the same pace at the other kernel packages, as it is not linked to a specific kernel version.
 
1 members found this post helpful.
Old 11-08-2019, 06:46 PM   #5
hitest
Guru
 
Registered: Mar 2004
Location: Canada
Distribution: Void, Slackware
Posts: 7,342

Original Poster
Rep: Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746Reputation: 3746
Code:
Fri Nov  8 23:23:40 UTC 2019
patches/packages/kdelibs-4.14.38-x86_64-2_slack14.2.txz:  Rebuilt.
  Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.
patches/packages/kdepim-4.14.10-x86_64-2_slack14.2.txz:  Rebuilt.
  Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.
patches/packages/kdepimlibs-4.14.10-x86_64-3_slack14.2.txz:  Rebuilt.
  Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.
patches/packages/linux-4.4.199/kernel-firmware-20191108_f1100dd-noarch-1.txz:  Upgraded.
+--------------------------+
 
Old 11-08-2019, 10:22 PM   #6
slackware-current
Member
 
Registered: Jun 2019
Posts: 60

Rep: Reputation: 6
Quote:
Originally Posted by Didier Spaier View Post
The right way to update is to follow these instructions: http://www.slackware.com/lists/archi...ecurity.756390

The kernel-firmware package is not upgraded at the same pace at the other kernel packages, as it is not linked to a specific kernel version.
Do it the correct way Like Didier Spaier says 1 = 1 buckle my shoe
D your the best
Last edited by slackware-current; 11-08-2019 at 10:24 PM.
 
Old 11-10-2019, 08:55 AM   #7
drgibbon
Senior Member
 
Registered: Nov 2014
Distribution: Slackware64 15.0
Posts: 1,217

Rep: Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942
Quote:
Originally Posted by Didier Spaier View Post
The right way to update is to follow these instructions: http://www.slackware.com/lists/archi...ecurity.756390

The kernel-firmware package is not upgraded at the same pace at the other kernel packages, as it is not linked to a specific kernel version.
I had noticed when I upgraded that my kernel-firmware package had reverted from a 2019 to 2016 version (fixed now with the new firmware package that was pushed). But what exactly is the difference between:
Code:
upgradepkg kernel-*.txz
(as per the instructions in that link), and:
Code:
slackpkg upgrade-all
(which is how I usually do it).

Aren't they more or less equivalent in the case where only kernel packages updates are available? Why would `upgradepkg kernel-*.txz` not pick up kernel-firmware*.txz also? Isn't the reason for the downgrade that the patch disappeared, rather than not upgrading via `upgradepkg kernel-*.txz`?
Last edited by drgibbon; 11-10-2019 at 08:57 AM.
 
Old 11-10-2019, 12:23 PM   #8
ehartman
Senior Member
 
Registered: Jul 2007
Location: Delft, The Netherlands
Distribution: Slackware
Posts: 1,674

Rep: Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888
Quote:
Originally Posted by drgibbon View Post
Why would `upgradepkg kernel-*.txz` not pick up kernel-firmware*.txz also?
Because it wasn't there in THAT directory (linux-4.4.199) yet (they were only added a day later), so slackpkg picked up the one for the original distribution instead (from the configured slackware mirror).
upgradepkg will never go to the internet, so will only upgrade the kernel packages you just downloaded.
I noticed when downloading the new kernel packages too that this upgrade didn't include the firmware, so I kept the ones from 4.4.190 (just moved them to another directory).
Last edited by ehartman; 11-10-2019 at 12:25 PM.
 
Old 11-10-2019, 04:00 PM   #9
drgibbon
Senior Member
 
Registered: Nov 2014
Distribution: Slackware64 15.0
Posts: 1,217

Rep: Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942
Ahh ok thanks, so with upgradepkg you're manually downloading the updated kernel packages first? Makes sense then if so.

But why would the older 2019 firmware disappear before the new one goes up (causing slackpkg to revert to an older firmware)? Just a glitch?
 
Old 11-10-2019, 06:48 PM   #10
ehartman
Senior Member
 
Registered: Jul 2007
Location: Delft, The Netherlands
Distribution: Slackware
Posts: 1,674

Rep: Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888
Quote:
Originally Posted by drgibbon View Post
But why would the older 2019 firmware disappear before the new one goes up (causing slackpkg to revert to an older firmware)? Just a glitch?
The older firmware was in a different directory (linux-4.4.190).
That whole directory got replaced BY the linux-4.4.199 one.

It probably would have been more consistent to put the firmware package into the /patches/packages directory instead of this versioned subdirectory.
But anyway, slackpkg is the wrong tool to update kernel packages, because normal you would want to "install" some of the packages (like the running kernel) and "upgrade" others (like the kernel source).
And you normally would have to install only one of the newer kernels, either the "huge" one or the "generic" one (and for the latter you would need to install the corresponding -modules one too).

I always download all of the new packages (into my private mirror) and then use either installpg or upgradepkg on the ones I need on my system.
 
1 members found this post helpful.
Old 11-13-2019, 07:01 AM   #11
ehartman
Senior Member
 
Registered: Jul 2007
Location: Delft, The Netherlands
Distribution: Slackware
Posts: 1,674

Rep: Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888
Quote:
Originally Posted by ehartman View Post
The older firmware was in a different directory (linux-4.4.190).
That whole directory got replaced BY the linux-4.4.199 one.
Note: with the Slackware 14.2 update to a 4.4.201 kernel the -firmware package has disappeared again!
So do NOT use slackpkg for kernel update packages or your firmware will be downgraded again.
 
Old 11-13-2019, 07:16 AM   #12
drgibbon
Senior Member
 
Registered: Nov 2014
Distribution: Slackware64 15.0
Posts: 1,217

Rep: Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942Reputation: 942
Quote:
Originally Posted by ehartman View Post
Note: with the Slackware 14.2 update to a 4.4.201 kernel the -firmware package has disappeared again!
So do NOT use slackpkg for kernel update packages or your firmware will be downgraded again.
kernel-firmware-20191108_f1100dd-noarch-1.txz is in /patches now though, so slackpkg is not offering a downgrade for me with `slackpkg upgrade-all`.
 
Old 11-13-2019, 08:42 PM   #13
ehartman
Senior Member
 
Registered: Jul 2007
Location: Delft, The Netherlands
Distribution: Slackware
Posts: 1,674

Rep: Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888Reputation: 888
Quote:
Originally Posted by drgibbon View Post
kernel-firmware-20191108_f1100dd-noarch-1.txz is in /patches now though, so slackpkg is not offering a downgrade for me with `slackpkg upgrade-all`.
Yes, Pat moved it up 1 directory after the original upgrade:
Quote:
patches/packages/linux-4.4.199/kernel-firmware-20191108_f1100dd-noarch-1.txz: Upgraded.
(note the directory linux-4.4.199 in there, which has now disappeared) so the problem has been solved.
patches/packages is a better directory for it anyway, as it is not kernel version related - as mentioned before: kernel-firmware has its own release schedule.
 
2 members found this post helpful.
Old 11-16-2019, 07:12 PM   #14
magicm
Member
 
Registered: May 2003
Distribution: Slackware
Posts: 236

Rep: Reputation: 152Reputation: 152
Thank you, Pat!!
Code:
Sat Nov 16 20:35:54 UTC 2019
patches/packages/linux-4.4.202/*:  Upgraded.
   CRYPTO_CRC32C_INTEL m -> y
  +X86_INTEL_TSX_MODE_AUTO n
  +X86_INTEL_TSX_MODE_OFF y
  +X86_INTEL_TSX_MODE_ON n
  These updates fix various bugs and security issues, including mitigation for
  the TSX Asynchronous Abort condition on some CPUs.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 4.4.201:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0155
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0154
    Fixed in 4.4.202:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11135
  (* Security fix *)
Code:
root@igloo: Sat Nov 16 19:04:43 : ~
# inxi
CPU: Dual Core Intel Core i5-2540M (-MT MCP-) speed/min/max: 843/800/3300 MHz Kernel: 4.4.202 x86_64 Up: 52m 
Mem: 931.8/7856.7 MiB (11.9%) Storage: 931.51 GiB (18.7% used) Procs: 200 Shell: bash 4.3.48 inxi: 3.0.36
Code:
# /home/magic/Downloads/spectre-meltdown-checker.sh --batch
CVE-2017-5753: OK (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
CVE-2017-5715: OK (Full retpoline + IBPB are mitigating the vulnerability)
CVE-2017-5754: OK (Mitigation: PTI)
CVE-2018-3640: OK (your CPU microcode mitigates the vulnerability)
CVE-2018-3639: OK (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
CVE-2018-3615: OK (your CPU vendor reported your CPU model as not vulnerable)
CVE-2018-3620: OK (Mitigation: PTE Inversion)
CVE-2018-3646: OK (this system is not running a hypervisor)
CVE-2018-12126: OK (Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled)
CVE-2018-12130: OK (Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled)
CVE-2018-12127: OK (Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled)
CVE-2019-11091: OK (Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled)
CVE-2019-11135: OK (your CPU vendor reported your CPU model as not vulnerable)
root@igloo: Sat Nov 16 19:09:11 : ~
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
New Kernel Slackware 14.2- bug and security fixes. hitest Slackware 1 01-31-2019 01:41 PM
LXer: Debian GNU/Linux 9.2 "Stretch" Update Introduces Over 150 Security and Bug Fixes LXer Syndicated Linux News 0 10-08-2017 12:42 AM
LXer: Debian 9.1 (Stretch) Brings Security Fixes For Anonymous Connections Over Tor And Drupal 7 CMS & Apache 2 Fixes LXer Syndicated Linux News 0 07-23-2017 04:57 PM
LXer: Apache CloudStack Open Source Cloud updated for Security and Bug Fixes LXer Syndicated Linux News 0 04-26-2013 12:11 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 06:55 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration