[Bug 1891061] Re: SRU: Bootable buildd images boot vulnerable kernels

[Cody Shepherd]

I've verified that this is fixed for Focal by:

* Building the livecd-rootfs 2.664.5 source package in a private ppa
* Building the focal buildd image with the cpc-buildd livefs, with the above private-ppa as an extra archive
* Booting the resulting disk-linux-virtual.img in Multipass with libvirt as the local driver, and verifying that a) the running kernel was updated (5.4.0-42.46-generic in this case), and b) -updates and -security were enabled in the apt sources.list

Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/1891061

Title:
  SRU: Bootable buildd images boot vulnerable kernels

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Focal:
  Fix Committed

Bug description:
  [Impact]

   * Bootable buildd images are currently built from the -release pocket only,
     leaving them vulnerable to issues fixed by -updates and/or -security.

   * MP: #387164 [1] should be backported to ensure updated packages are used
     when building the bootable buildd images.

  [Test Case]

   * Inspect package manifest for bootable buildd images; verify outdated versions
     of packages

  [Regression Potential]

   * updated packages could break current assumptions for bootable buildd images, and cause
     boot or runtime failures, though this has not been seen in testing.

  1. https://code.launchpad.net/~codyshepherd/livecd-rootfs/+git/livecd-
  rootfs/+merge/387164

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/1891061/+subscriptions