search

sipeed / NanoKVM

NanoKVM: Affordable, Multifunctional, Nano RISC-V IP-KVM
848 stars 7 forks source link

Linux kernel on system image 1.2.0 might be almost 4 years old #22

Open ajorg opened 2 weeks ago

ajorg commented 2 weeks ago

The Linux kernel reports version 5.10.4, which was released in December 2020. That means it's missing almost 4 years of critical security fixes. The system firmware needs to be maintained to be more current in order to be safe to use.

ajorg commented 2 weeks ago

I think it's worth challenging, more generally, this notion (from System Overview):

Firmware updates include major system features and hardware adaptations. These need to be downloaded from GitHub and re-flashed onto the SD card, and are pushed less frequently.

Because of the number of components on the system image, and their use in other projects, security issues will be far more frequently found in components on the system image than in the application. Both need to be updated frequently, and given the difficulty of removing the SD card to flash it, and the loss of any configuration in this case, I think it would be good to use something like RAUC or SWUpdate, both of which are supported by Buildroot.

AkechiShiro commented 4 days ago

I believe openssh is also vulnerable to an unauthenticated RCE OpenSSH 9.6 even after updating (on the web interface), it is still vulnerable, if glibc is being used then this CVE is impacting the latest nanoKVM release I believe :

Will check if I flash the latest pre release if openSSH has been bumped or not.