A penetration tester performs a credentialed Nessus scan of a Linux server and receives a critical finding related to an unpatched kernel vulnerability. However, when the tester manually checks the kernel version using `uname -r`, the version shown matches the patched version. What should the tester investigate NEXT?

Question

Accepted Answer

B. Check if the system requires a reboot to complete the kernel update. Linux kernel updates often require a reboot to take effect because the running kernel in memory is not replaced until restart. If the scanner detects an installed kernel package that is vulnerable while the running kernel version (shown by `uname -r`) is the new patched version, the system is in a transitional state. The vulnerability persists in memory until reboot, so confirming whether a reboot is needed is the correct next step.

Related Questions

Discussion