I just need to gush for a minute. I am about to shutdown my server in order to move it to the basement. This off the shelf $300 desktop running Pop!_OS is my self-hosting server that has dutifully done it’s job without a single complaint. It has been rebooted maybe three times since 2020 and it currently has an uptime of 840 days. That’s 840 days of not ever thinking about this thing. It self updates via Cron jobs and just…works.
I am afraid to open the box up though. Those dust bunnies must be huge.
The kernel has tons of vulnerabilities that get patched with updates. You really shouldn’t be running a older kernel for that long
Sure, but those vulnerabilities aren’t just open to the network. Almost every one requires you to be able to run at least unprivileged arbitrary code on the machine.
Usually but are you paying close enough to the security notices to know when it isn’t?
It’s very big news when there’s a vulnerability in the Linux kernel itself that can be remotely exploited. Like, everyone on any security show/podcast/blog is talking about it.
https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33
Cool, CVEs don’t tell you whether it’s remotely exploitable. What I’m talking about is an issue with the Linux kernel itself that can be exploited without having the existing ability to run code on the machine.
True, you do need to look at the exploitablity score. You are right almost all of the CVEs are not easily exploitable.
However, assuming your device is secure isn’t a great idea. I think it is wise to just update so you don’t have to worry about it. It is relative simple to update and reboot if needed.