Possible Software RAID Issue With Recent mdadm Package

We identified an issue with mdadm version "mdadm - v4.4 - 2024-11-07 - 4" that can cause software RAID issues after a reboot. We have removed this version and pushed a downgraded version "mdadm - v4.4 - 2024-11-07 - 2" to the Security Onion repo.

If you are not running software RAID, then you should not be affected at all.

If you are running software RAID, then you should check to see what version of the mdadm package is installed on all of your grid members to see if they need to be downgraded.

Please note that the following instructions assume that you installed using our official Security Onion ISO image. If you are using some other unsupported installation method, then your mileage may vary.

Check the existing mdadm version on all grid nodes:

sudo salt \* cmd.run 'mdadm --version'

If all grid nodes show version "mdadm - v4.4 - 2024-11-07 - 2", then you are running the correct version.

If one or more grid nodes have version "mdadm - v4.4 - 2024-11-07 - 4" then you need to downgrade mdadm:

sudo salt \* cmd.run 'echo y | dnf downgrade mdadm'

Once that completes, then verify the downgraded version on all nodes:

sudo salt \* cmd.run 'mdadm --version'

Security Onion and Linux Kernel Dirty Frag Vulnerability CVE-2026-43284

There is a new local privilege escalation called Dirty Frag (CVE-2026-43284):

https://access.redhat.com/security/cve/cve-2026-43284

Updated kernel packages should be coming soon to resolve this issue. If you can't wait until updated kernels are released and need to apply a temporary mitigation, please see the Mitigation section of the article above and also:

https://github.com/V4bel/dirtyfrag#mitigation

Security Onion and Linux Kernel Copy Fail Vulnerability CVE-2026-31431

A flaw was found in the Linux kernel that allows for local privilege escalation:

https://access.redhat.com/security/cve/cve-2026-31431

Updated kernel packages should be coming soon to resolve this issue.

UPDATE 2026/05/04 Oracle has released an updated UEK kernel (5.15.0-319.201.4.4) to address this vulnerability (https://linux.oracle.com/errata/ELSA-2026-50253.html). Assuming you're running Security Onion on Oracle 9 with the Oracle UEK kernel, you can update to this new kernel with a standard soup (https://docs.securityonion.net/en/3/main/soup/) followed by a reboot.

If you can't wait until updated kernels are released and need to apply a temporary mitigation, you can run the following command and then reboot:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

After updated kernels are released, that temporary mitigation can be reverted by running the following command and then rebooting:

sudo grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

 

securityonion-pfring-module - 20121107-0ubuntu0securityonion31 now available for Security Onion 16.04!

securityonion-pfring-module - 20121107-0ubuntu0securityonion31 is now available for Security Onion 16.04 and should resolve the following issues:

securityonion-pfring-module: compile on kernel 4.15 #1274
https://github.com/Security-Onion-Solutions/security-onion/issues/1274

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Ubuntu 16.04 with HWE and PF_RING

Introduction
This blog post only applies to you if you installed our Security Onion 16.04 ISO images OR if you installed Ubuntu 16.04 with the HWE stack:
https://wiki.ubuntu.com/Kernel/LTSEnablementStack
https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack

As of this morning, it appears that Ubuntu has rolled the Ubuntu 16.04 HWE stack to 18.04 which means a 4.15 Linux kernel.

Problem
Our current PF_RING module will not compile on kernel 4.15.  If you upgrade to 4.15, you will have a failed PF_RING module and services that use PF_RING such as Snort, Suricata, and Bro, may not work properly.

Solution
We will be building new PF_RING packages to ensure compatibility with this new HWE stack.  In the meantime, please use the following guidance.

If you haven't already updated, we recommend avoiding updates until we have the new PF_RING packages available. 

If you've already updated, you can boot your machine(s) to the previous kernel by choosing "Advanced options" at the grub boot menu and then selecting the 4.13 kernel.

Updated 2018/07/02 12:27 PM Eastern
We've released an updated securityonion-pfring-module package that should resolve this issue, so you should now be able to install updates normally.
https://blog.securityonion.net/2018/07/securityonion-pfring-module-20121107.html

Ubuntu Hardware Enablement (HWE) Stacks

Summary

If you installed Security Onion using our ISO image, then you should be running the original 3.2 kernel which should be fully supported until April 2017.  However, if you installed Ubuntu and then added our PPA and packages, you may be running a Hardware Enablement (HWE) Stack that has reached End-of-life.  If this is the case, then you'll need to update to a newer HWE Stack that will continue to be supported.

Checking Your System using hwe-support-status
To check your system, run the following command:

hwe-support-status tool --verbose

For example, in the following screenshot, I'm running the command on a machine that was installed from the Security Onion ISO image.  If this is what you get, then you can disregard the rest of this blog post.

If, on the other hand, you receive output similar to the following screenshot (taken from a machine that was installed from an Ubuntu ISO image), then you'll need to update to a newer HWE Stack.

WARNING! Do NOT run the do-release-upgrade command as this will upgrade to Ubuntu 14.04, which is incompatible with our packages.  We'll be using the second "apt-get install" option to update the HWE stack.

Updating your HWE Stack
Before you update your HWE stack, make sure that you've installed all updates so that you have the new PF_RING packages that support Linux kernel 3.13:
http://blog.securityonion.net/2014/08/new-pfring-snort-suricata-bro-packages.html

You can verify that you have the new PF_RING 6.0.2 with "cat /proc/net/pf_ring/info":

Then run the apt-get command shown in *your* output of hwe-support-status.  In the hwe-support-status screenshot above, we were requested to run the following because we were just running Ubuntu Server (no GUI):

sudo apt-get install linux-generic-lts-trusty linux-image-generic-lts-trusty

Depending on how your system was installed, hwe-support-status may ask you to install additional packages.  For example, you may also be requested to update your xserver packages.  Run whatever command hwe-support-status recommends for you.

If the new HWE stack installed successfully, then reboot your system:

After rebooting and logging in, verify that you're running the new 3.13 kernel with the "uname -a" command:

You can also verify that the PF_RING kernel module got built and loaded correctly for the new 3.13 kernel:

Finally, run the hwe-support-status tool again to verify that your HWE stack is supported until April 2017:

For more information about Ubuntu HWE Stacks, please see:

https://wiki.ubuntu.com/Kernel/LTSEnablementStack

https://wiki.ubuntu.com/1204_HWE_EOL

Feedback

If you have any questions or problems, please use our security-onion mailing list:

https://code.google.com/p/security-onion/wiki/MailingLists

Conference

Less than 30 seats left for the Security Onion conference in Augusta GA! Reserve your seat today!

https://securityonionconference2014.eventbrite.com

Commercial Support/Training

Need training and/or commercial support?  Please see:

http://securityonionsolutions.com

Help Wanted

If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:

https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:

http://groups.google.com/group/security-onion

We also need help testing new packages:

http://groups.google.com/group/security-onion-testing

Thanks!