grsecurity - The Reports of CVE's Death Have Been Greatly Exaggerated
grsecurity.net
A prominent Linux kernel developer wants to replace CVE's use on the kernel by rebranding another kind of identifier that has been around for years. We look into why that's unlikely to happen any time soon.

This basically means that fixes for most security vulnerabilities are not be able to be back-ported to LTS kernels but on the other side around stable releases contain all security fixes made so far.

In other words, use stable Kernels over LTS, whenever possible, assuming everything works for you and there are no specific circumstances such as working in an environment where you have no control over the Kernel - limited access etc.

  • CHEF-KOCHOP
    0•2 years ago

    I think I provided enough evidence to support this. I expected more as counter arguments that newer features in newer kernels can increase attack surface but this is all what there is on counter arguments.

    Examples that are not in LTS are Lockdown LSM, STACKLEAK GCC plugin + Spectrev2.

    • @kevincox
      1•2 years ago

      Missing hardening features is very different than missing fixes. I would expect that LTS kernels don’t get new major features such as hardening changes even if they “improve security”.

      • CHEF-KOCHOP
        -5•2 years ago

        The point is that what you call hardening features can help to address known vulnerabilities. This will increase security one way or another.

        Now bring evidence that I am wrong, whops there is none.

        • @kevincox
          4•2 years ago

          Sure. I agree with “Prefer stable kernels because they have the latest security harderning”. I was just disagreeing with “most security vulnerabilities are not be able to be back-ported to LTS kernels”.

          Now bring evidence that I am wrong

          Haha. Good joke. Not worth responding to.