forked from linux/documentation
32 lines
1.3 KiB
Markdown
32 lines
1.3 KiB
Markdown
# Mitigation copy.fail
|
|
!!!hint
|
|
The latest RHEL kernels do not include the vulnerability anymore, so please update to `kernel-4.18.0-553.123.1.el8_10` (RHEL8) or `kernel-5.14.0-611.54.1.el9_7` (RHEL9).
|
|
**With this or newer kernels below mitigation is not required**.
|
|
|
|
Following command can be used to disable the vulnerable feature in the current default kernel.
|
|
|
|
```bash
|
|
# Blacklist algif_aead_init
|
|
grubby --update-kernel="$(grubby --default-kernel)" --args="initcall_blacklist=algif_aead_init"
|
|
|
|
# Reboot the system
|
|
reboot now
|
|
|
|
# Verify the parameter
|
|
cat /proc/cmdline | grep initcall_blacklist
|
|
|
|
# double check loaded Kernel
|
|
uname -r
|
|
|
|
|
|
# [root@lx-term-02 ~]# cat /proc/cmdline | grep initcall_blacklist
|
|
# BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-611.42.1.el9_7.x86_64 root=/dev/mapper/vg_root-lv_root ro crashkernel=1G-2G:192M,2G-64G:256M,64G-:512M resume=UUID=4cfc7133-5787-42ec-bfbe-1fd3fbfb643f rd.lvm.lv=vg_root/lv_root initcall_blacklist=algif_aead_init
|
|
# [root@lx-term-02 ~]# uname -r
|
|
# 5.14.0-611.42.1.el9_7.x86_64i
|
|
```
|
|
|
|
The suggested mitigation by RedHat will affect all installed kernels and future kernels, but we assume that the next kernel update by RedHat will include the patch with the fix.
|
|
|
|
Source: [https://access.redhat.com/solutions/7141931](https://access.redhat.com/solutions/7141931)
|
|
|