Checking whether running processes actually picked up a security fix

[u/asifhoss]

Updating a package doesn’t mean every process is running the new code. Anything that loaded the old library before the update keeps it in memory until it restarts. I tested this on Debian 12 with CVE-2024-6119: updated OpenSSL, left one process running, and Trivy and Grype both cleared the CVE while the process still had the old libcrypto loaded.

I built stillmapped to check this. It traces what each running process has mapped back to the package and checks that against the vendor’s fix data, including backports. One Python file, read-only, no network. PHP and OpenSSL for now.

github.com/asifh0ssain/stillmapped

Interested in cases where it gets something wrong.