Patched is not fixed until the vulnerable code stops running.
Package scanners usually close a finding when the fixed version lands on disk. That is not enough. Kernels still need reboots. Long-running services still map old libraries. oxharden keeps the finding open until applied and live state agree.
The package database can say clean while the process table says vulnerable.
Run an upgrade and the package database flips to the fixed build. By version alone, the host reads as clean — which is exactly where most scanners stop. But the code that matters is the code still executing.
Libraries
A library fix is not live until every service that mapped it restarts. Long-running processes can keep the old code in memory, often visible as deleted inodes.
Kernels
A kernel CVE is not closed until the host reboots. The fixed image can sit staged on disk while the vulnerable kernel keeps running.
False green
The package is fixed. The risk is not. Every one of these reads clean to a version-only scanner.
How oxharden tells applied from live.
On disk
The package manager reports the fixed build installed. Most scanners stop here.
In memory
oxharden inspects running processes and maps which services still load old library objects — the code actually executing right now.
Kernel
oxharden compares the running kernel against the installed kernel to surface reboot-pending risk.
Reconcile
A finding stays open until applied and live agree. Green means actually fixed.
The next action is restart, reboot, or upgrade — not guesswork.
oxharden flags every host where applied and live state disagree and tells you the follow-up: restart these services, reboot this host, or upgrade this package. Where available, copy the Bash or Ansible guidance, apply it, and re-scan to prove the risk is retired.
| Host | Why it's still open | Action | Scope |
|---|---|---|---|
| ip-10-20-2-107 | 3 services map stale libssl.so.3 | restart | 3 svc |
| ip-10-20-4-32 | kernel 5.14.0-427 running, reboot pending | reboot | 1 host |
| ip-10-20-7-15 | openssl-libs below fixed-in version | upgrade | 1 pkg |
Read-only collection. Least-privilege design. Installs in 2 minutes.
Stop trusting package state. Verify runtime state.
Explore the live demo and see how oxharden separates applied from live, then run it a 14-day free trial on up to 30 of your own hosts.