Esta página no se ha traducido a su idioma. Solicitar traducción

Kernel Live Patching on AL2

Kernel Live Patching for AL2 allows you to apply specific security vulnerability and critical bug patches to a running Linux kernel, without reboots or disruptions to running applications. This allows you to benefit from improved service and application availability, while applying these fixes until the system can be rebooted.

For information about Kernel Live Patching for AL2023, see Kernel Live Patching on AL2023 in the Amazon Linux 2023 User Guide.

AWS releases two types of kernel live patches for AL2:

AWS provides kernel live patches for an AL2 kernel version for up to 3 months after its release. After the 3-month period, you must update to a later kernel version to continue to receive kernel live patches.

AL2 kernel live patches are made available as signed RPM packages in the existing AL2 repositories. The patches can be installed on individual instances using existing yum workflows, or they can be installed on a group of managed instances using AWS Systems Manager.

Kernel Live Patching on AL2 is provided at no additional cost.

Supported configurations and prerequisites

Kernel Live Patching is supported on Amazon EC2 instances and on-premises virtual machines running AL2.

To use Kernel Live Patching on AL2, you must use:

Policy Requirements

To download packages from Amazon Linux repositories, Amazon EC2 needs access to service-owned Amazon S3 buckets. If you are using a Amazon Virtual Private Cloud (VPC) endpoint for Amazon S3 in your environment, you need to ensure that your VPC endpoint policy allows access to those public buckets.

The table describes each of the Amazon S3 buckets that EC2 might need to access for Kernel Live Patching.

The following policy illustrates how to restrict access to identities and resources that belong to your organization and provide access to the Amazon S3 buckets required for Kernel Live Patching. Replace region, principal-org-id and resource-org-id with your organization’s values.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowRequestsByOrgsIdentitiesToOrgsResources",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "principal-org-id",
          "aws:ResourceOrgID": "resource-org-id"
        }
      }
    },
    {
      "Sid": "AllowAccessToAmazonLinuxAMIRepositories",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::packages.region.amazonaws.com/*",
        "arn:aws:s3:::repo.region.amazonaws.com/*",
        "arn:aws:s3:::amazonlinux.region.amazonaws.com/*",
        "arn:aws:s3:::amazonlinux-2-repos-region/*"
      ]
    }
  ]
}
    

Work with Kernel Live Patching

You can enable and use Kernel Live Patching on individual instances using the command line on the instance itself, or you can enable and use Kernel Live Patching on a group of managed instances using AWS Systems Manager.

The following sections explain how to enable and use Kernel Live Patching on individual instances using the command line.

For more information about enabling and using Kernel Live Patching on a group of managed instances, see Use Kernel Live Patching on AL2 instances in the AWS Systems Manager User Guide.

Enable Kernel Live Patching

Kernel Live Patching is disabled by default on AL2. To use live patching, you must install the yum plugin for Kernel Live Patching and enable the live patching functionality.

Prerequisites

Kernel Live Patching requires binutils. If you do not have binutils installed, install it using the following command:

$ sudo yum install binutils

View the available kernel live patches

Amazon Linux security alerts are published to the Amazon Linux Security Center. For more information about the AL2 security alerts, which include alerts for kernel live patches, see the Amazon Linux Security Center. Kernel live patches are prefixed with ALASLIVEPATCH. The Amazon Linux Security Center might not list kernel live patches that address bugs.

You can also discover the available kernel live patches for advisories and CVEs using the command line.

To list all available kernel live patches for advisories

Use the following command.

$ yum updateinfo list

The following shows example output.

Loaded plugins: extras_suggestions, kernel-livepatch, langpacks, priorities, update-motd
ALAS2LIVEPATCH-2020-002 important/Sec. kernel-livepatch-5.10.102-99.473-1.0-3.amzn2.x86_64
ALAS2LIVEPATCH-2020-005 medium/Sec. kernel-livepatch-5.10.102-99.473-1.0-4.amzn2.x86_64
updateinfo list done

To list all available kernel live patches for CVEs

Use the following command.

$ yum updateinfo list cves

The following shows example output.

Loaded plugins: extras_suggestions, kernel-livepatch, langpacks, priorities, update-motdamzn2-core/2/x86_64 | 2.4 kB 00:00:00 
CVE-2019-15918 important/Sec. kernel-livepatch-5.10.102-99.473-1.0-3.amzn2.x86_64
CVE-2019-20096 important/Sec. kernel-livepatch-5.10.102-99.473-1.0-3.amzn2.x86_64
CVE-2020-8648 medium/Sec. kernel-livepatch-5.10.102-99.473-1.0-4.amzn2.x86_64
updateinfo list done

Apply kernel live patches

You apply kernel live patches using the yum package manager in the same way that you would apply regular updates. The yum plugin for Kernel Live Patching manages the kernel live patches that are available to be applied.

You can choose to apply a specific kernel live patch, or to apply any available kernel live patches along with your regular security updates.

To apply any available kernel live patches along with your regular security updates

Use the following command.

$ sudo yum update --security

Omit the --security option to include bug fixes.

View the applied kernel live patches

To view the applied kernel live patches

Use the following command.

$ kpatch list

The command returns a list of the loaded and installed security update kernel live patches. The following is example output.

Loaded patch modules:
livepatch_cifs_lease_buffer_len [enabled]
livepatch_CVE_2019_20096 [enabled]
livepatch_CVE_2020_8648 [enabled]
	
Installed patch modules:
livepatch_cifs_lease_buffer_len (5.10.102-99.473.amzn2.x86_64)
livepatch_CVE_2019_20096 (5.10.102-99.473.amzn2.x86_64)
livepatch_CVE_2020_8648 (5.10.102-99.473.amzn2.x86_64)

Disable Kernel Live Patching

If you no longer need to use Kernel Live Patching, you can disable it at any time.

Limitations

Kernel Live Patching has the following limitations:

Frequently asked questions

For frequently asked questions about Kernel Live Patching for AL2, see the Amazon Linux 2 Kernel Live Patching FAQ.