KernelCare

<h2 id="overview">Overview</h2>
<p class="note">See also: <a href="/facts/Linux_kernel/dlkduHuA">Linux kernel § Live patching</a></p>
<p>KernelCare agent resides on user's <a href="/facts/Server_(computing)/dEaYFD7r">server</a>. It periodically checks in with KernelCare distribution servers. If there are new patches available for the currently running <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">kernel</a>, KernelCare agent downloads and applies those patches to the running kernel.
</p><p>A KernelCare <a href="/facts/Patch_(computing)/sIHVBPls">patch</a> is a piece of code used to substitute vulnerable or buggy code in a kernel. It can be an arbitrary code line modification, or it can be a missing security check, a set of functions, or even modified data structures.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a>
The patch is compiled as usual, but the generated code has additional information about all changed code pieces caused by original source code modification and information on to how to apply these code pieces. The resulting code modifications are safely applied to the running kernel.
</p><p>A special KernelCare <a href="/facts/Kernel_module/UXvHsj2c">kernel module</a> applies the patches. It loads the patches into the kernel address space, sets up the relocations (i.e., fixes the references to the original kernel code and data), and safely switches the execution path from the original code to updated code blocks. The code ensures the patch is applied safely so the <a href="/facts/CPU/Jxp1bqMV">CPU</a> doesn't execute the original code blocks at the same moment when switching to a new version.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a>
</p>
<h2 id="see-also">See also</h2>
<ul>
<li>Linux portal</li></ul>
<ul><li><a href="/facts/Dynamic_software_updating/QtR9Cx8a">Dynamic software updating</a>, a field of research focusing on upgrading programs while they are running</li>
<li><a href="/facts/Kexec/Hc0cGXpA">kexec</a>, a method for loading a whole new kernel from a running system</li>
<li><a href="/facts/KGraft/BGBuTAwU">kGraft</a>, <a href="/facts/Kpatch/3FsJ6Mle">kpatch</a> and <a href="/facts/Ksplice/h4WT9suJ">Ksplice</a>, other Linux kernel live patching technologies developed by SUSE, Red Hat and Ksplice, Inc. (later acquired by Oracle), respectively</li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://kernelcare.com">Official website</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"KernelCare Promises Linux Security Updates Without the Reboots". The Var Guy. Archived from the original on 14 September 2016. Retrieved 29 August 2015. <a href="https://web.archive.org/web/20160914232344/http://thevarguy.com/open-source-application-software-companies/050614/embargo-may-6-1201-am-est-kernelcare-promises-linux-secur" target="_blank">https://web.archive.org/web/20160914232344/http://thevarguy.com/open-source-application-software-companies/050614/embargo-may-6-1201-am-est-kernelcare-promises-linux-secur</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>"KernelCare: New no-reboot Linux patching system". ZDNet. Retrieved 29 August 2015. <a href="https://www.zdnet.com/article/kernelcare-new-no-reboot-linux-patching-system/" target="_blank">https://www.zdnet.com/article/kernelcare-new-no-reboot-linux-patching-system/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>"KernelCare: New no-reboot Linux patching system". ZDNet. Retrieved 29 August 2015. <a href="https://www.zdnet.com/article/kernelcare-new-no-reboot-linux-patching-system/" target="_blank">https://www.zdnet.com/article/kernelcare-new-no-reboot-linux-patching-system/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>"CloudLinux Launches KuberDock Public Beta". Archived from the original on 17 August 2016. Retrieved 29 August 2015. <a href="https://web.archive.org/web/20160817073351/http://www.thehostingnews.com/cloudlinux-launches-kuberdock-public-beta.html" target="_blank">https://web.archive.org/web/20160817073351/http://www.thehostingnews.com/cloudlinux-launches-kuberdock-public-beta.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"KernelCare verspricht Patches ohne Neustart". Pro-Linux. Retrieved 29 August 2015. <a href="http://www.pro-linux.de/news/1/21062/kernelcare-verspricht-patches-ohne-neustart.html" target="_blank">http://www.pro-linux.de/news/1/21062/kernelcare-verspricht-patches-ohne-neustart.html</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
</ol>

KernelCare open-in-new

KernelCare