Home / ubuntu / Questions / 1143535
In Process
Houman
Asked: 2019-05-16 10:50:55 +0800 CST

canonical-livepatch, Doesn't seem to patch anything

  • 772

When I ssh into the server it says:

11 packages can be updated.
11 updates are security updates.

Then I verify that everything is installed:

canonical-livepatch status --verbose

And this is what I get:

client-version: 9.3.0
machine-id: xxx
machine-token: xxx
architecture: x86_64
cpu-model: Intel(R) Xeon(R) CPU E3-1246 v3 @ 3.50GHz
last-check: 2019-05-15T18:08:12Z
boot-time: 2019-05-11T10:06:52Z
uptime: 104h34m56s
status:
- kernel: 4.15.0-48.51-generic
  running: true
  livepatch:
    checkState: checked
    patchState: nothing-to-apply
    version: ""
    fixes: ""

So there is nothing to apply? How about those 11 security updates then?

UPDATE:

As requested this is the list of upgradeable:

apt list --upgradable



intel-microcode/bionic-security,bionic-updates,bionic-updates,bionic-security 3.20190514.0ubuntu0.18.04.2 amd64 [upgradable from: 3.20180807a.0ubuntu0.18.04.1]
libwbclient0/bionic-security,bionic-updates,bionic-updates,bionic-security 2:4.7.6+dfsg~ubuntu-0ubuntu2.10 amd64 [upgradable from: 2:4.7.6+dfsg~ubuntu-0ubuntu2.9]
linux-generic/bionic-security,bionic-updates,bionic-updates,bionic-security 4.15.0.50.52 amd64 [upgradable from: 4.15.0.48.50]
linux-headers-generic/bionic-security,bionic-updates,bionic-updates,bionic-security 4.15.0.50.52 amd64 [upgradable from: 4.15.0.48.50]
linux-image-generic/bionic-security,bionic-updates,bionic-updates,bionic-security 4.15.0.50.52 amd64 [upgradable from: 4.15.0.48.50]
linux-libc-dev/bionic-security,bionic-updates,bionic-updates,bionic-security 4.15.0-50.54 amd64 [upgradable from: 4.15.0-48.51]
python3-distupgrade/bionic-updates,bionic-updates,bionic-updates,bionic-updates 1:18.04.32 all [upgradable from: 1:18.04.31]
ubuntu-release-upgrader-core/bionic-updates,bionic-updates,bionic-updates,bionic-updates 1:18.04.32 all [upgradable from: 1:18.04.31]
18.04 canonical-livepatch

1 Answers

  1. Does any of those 11 updates qualify?. If so file a bug report if they have not updated.

    Q: What kinds of updates will be provided by the Canonical Livepatch Service?

    A: The Canonical Livepatch Service is intended to address high and critical severity Linux kernel security vulnerabilities, as identified by Ubuntu Security Notices and the CVE database. Note that there are some limitations to the kernel livepatch technology -- some Linux kernel code paths cannot be safely patched while running. We will do our best to supply Canonical Livepatches for high and critical vulnerabilities in a timely fashion whenever possible. There may be occasions when the traditional kernel upgrade and reboot might still be necessary. We’ll communicate that clearly through the usual mechanisms -- USNs, Landscape, Desktop Notifications, Byobu, /etc/motd, etc.

    From the USN mailing list I would expect...

    • USN-3981-2: Linux kernel (HWE) vulnerabilities. 15.5.
    • USN-3980-2: Linux kernel (HWE) vulnerabilities. 15.5.
    • USN-3981-1: Linux kernel vulnerabilities. 14.5.

    to quality (the others are not marked as 18.04). As you only listed "11 updates": Have you had these installed on your server? Can you confirm if they are?

    • 1