The GNU Savannah story had a sting in the tail: the server ran a 5.15 kernel still open to 2023’s GameOver(lay) bugs. Here’s a quick check for your own Ubuntu-based machines.
1. What are you running vs. what’s installed?
uname -r # running kernel
dpkg -l 'linux-image-*' | awk '/^ii/{print $2,$3}' # installed kernels
apt list --upgradable 2>/dev/null | grep -i linux2. Did you install a fix but never reboot?
[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs
sudo needrestart -k # if needrestart is installed3. Ask about a specific CVE
pro fix CVE-2023-2640
pro fix CVE-2023-32629
pro security-statuspro fix tells you whether you’re affected and what package fixes it. It’s part of the Ubuntu Pro client, and the basic checks work without a paid subscription.
4. Keep it from happening again
- Turn on unattended-upgrades for security updates.
- Put kernel reboots on a calendar. A patched kernel that’s never booted is still unpatched.
- If you manage several boxes, put this in your config management (I use Ansible) instead of doing it by hand.
Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.
God Bless, and Happy hacking!
