10

Lets take CVE-2021-3448 as an example.

It's easy to see when the deb package got the backported fix, and what package is installed on the server.

But the same package in a snap:

/snap/lxd/21468/bin/dnsmasq --version
Dnsmasq version 2.80 .....
snap list
lxd     4.18      21468  latest/stable/…  canonical✓  -

Do you know if there is a way to see if that CVE is backported to 2.80 in the Canonical lxd snap somewhere?
Perhaps I am missing some really easy way to get this information.

0

1 Answer 1

9

With the deb update information, you're halfway there.

  1. Since LXD is distributed as a snap, you should always be running the latest version for your channel automatically. In this example, LXD 4.0.7 is in the stable channel, and installed on a 20.04 server:

    $ snap list lxd
    Name  Version  Rev    Tracking      Publisher   Notes
    lxd   4.0.7    21029  4.0/stable/…  canonical✓  -
    
  2. Next, let's head over to https://launchpad.net/lxd/+snaps and find that stable version...

    enter image description here

    ...aha. Here it is: https://launchpad.net/~ubuntu-lxc/+snap/lxd-4.0-candidate . You can see the build date --which is after the CVE (good)-- and a link to the build log for each architecture.

    enter image description here

  3. Let's take a closer look at that build log. This particular snap is built, under the hood, from debs! Let's zero in on the exact deb package used for the build.

    (Wait a second....It's the dnsmasq-base package instead of the dnsmasq package. No dnsmasq package suggests that the CVE may-or-may-not apply after all. However, let's overlook that and keep going for the final step)

  4. Finally, let's look at the Ubuntu Security Team CVE tracker to make sure that the package is properly fixed. Were the LXD snap using dnsmasq instead of dnsmasq-base, you can see that the build used a properly patched version (highlighted).

    • Remember that we're looking for the 18.04 (Bionic) package, since that's what was used to build the Snap.

    enter image description here

2
  • 3
    May you get many upvotes :) 2 thumbs up
    – Rinzwind
    Commented Sep 10, 2021 at 14:18
  • Marked as a correct answer. A huge thanks for your time!
    – Falk
    Commented Sep 10, 2021 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .