Vulnerability issues with CENTOS 7 VMs

[mraymus]

We've got a bunch of CENTOS 7 servers in our environment.    Recently we've started using Security Center to try and make sure our servers are secure and we've got a lot of remediation work to do.  However, we're thinking that a bunch of these CENTOS alerts we are getting are false positives.   Our CENTOS Servers are patched to the latest and greatest updates.  In fact, when I click on your remediation links, it tells me I need to be at the kernel 3.10.0-1160.31.1.el7.x86_64.      

When I go to my CENTOS servers and run a yum -y update to see if there are any updates for these servers, they are completely up to date and when I run a uname -a, the kernel information comes back with this:  3.10.0-1160.31.1.el7.x86_64  so I know we are on the latest and greatest kernel, despite the fact that Azure is telling us we need to update our kernel for security purposes. 

So, I'm not sure what to do at this point.   Is there a way for me to modify the alert so it can be resolved?   Do I open a ticket with Azure to let them know that it appears there's a problem?  Attached is a sample screenshot of what I'm seeing.   I haven't started investigating the Oracle Java SE stuff yet, just working on the CENTOS Security stuff.   

Please advise. 

Matt 

[#2]

Hello @mraymus,

I guess you are using Defender for server. Can you maybe try to trigger the vulnerability scanner manually on a CentOS machine, and see if the results are still false-positives:

sudo /usr/local/qualys/cloud-agent/bin/cloudagentctl.sh action=demand type=vm

You can also set an exemption with an expiration date but I would first try to understand why it triggers using the manual scan, and/or by contacting support indeed.

thank you

[#3]

we are having similiar issues... it seems as if the vulnerability assessment is also detecting old / not actively used versions of the kernel that are still residing on the server

[#4]

Thank you for your feedback. The best option would be to open a support ticket so that our engineers can collect logs, etc. and find the root cause of the issue.

[#5]

yep, ticket was created. It seems as if this by design. To be honest, as long as I cannot filter for vulnerabilities of the running vs the nonrunning kernel, I will not be able to use the vulnerability assessment solution

[#6]

are you using Qualys or MDE TVM for VA?

[#7]

Qualys