Upgrade of kernel for leap second vulnerability

Question

关于获取正确的软件包：Red Hat 更新提供给付费客户（当前订阅持有者），可以从以下位置访问https://access.redhat.com/ if yum is not configured with your subscription and/or excluding/missing the updates channel.

If you don't have a current subscription and don't want to get one, the suggested approach is to go the route of CentOS, which is derived from and binary compatible with Red Hat.

Regardless the recommended approach is of course to regularly patch your environment.

RHEL 6.1 is a RHEL 6 system that has not been patched since 2011 so compared to everything else, this patch is a really interesting one to start losing sleep over.

Due to the complete binary and ABI compatibilities within a major Red Hat release and back-porting more or less the only reason valid reason for most to not maintain a roughly current patch level is a dependancy on a specific kernel package. Apparently that is not the issue for you.

Red Hat also has two documented work-arounds which allows you to more or less ignore the actual leap second and slew the clock slowly instead.

stop ntpd
run ntptime -s 0 to reset the kernel status
run ntptime and verify it doesn't print INS or DEL on the status line
run the system now without ntp active during the leap second
at some point in the future you might want to sync the systems idea of time again with the rest of the world

Or alternatively:

stop ntpd
run ntptime -s 0 -f 0 beforehand to reset the kernel status and frequency
configure ntp with the -x option (ntp slew mode)
start ntpd (now in slew mode), have it running during the leap second.

Answer 1