kernel vulnerabilities update and server reboot

Question

A few kernel high priority vulnerabilities have been published today: https://ubuntu.com/security/notices/USN-5317-1

As I'm managing several Ubuntu servers, I was checking a few of them and I'm not quite sure if my servers are protected or not. All servers are running Ubuntu 20.04 and have unattended-upgrades package properly setup.

I noticed that unattended-upgrades has installed the latest kernel release 5.4.0-104 on several servers (but not on all of them though)... (?)

Does this mean that the servers are protected? or do I absolutely need to reboot them in order to load the new kernel?

Answer 1

You will normally have to reboot to load the new kernel and offer protection.

However, there are certain other options to offer protection without rebooting (known as live-patching).

One option is Livepatch by Canonical, which requires snap to run (see this question). This option will only offer the most critical kernel updates as livepatches.

Another option is KernelCare by CloudLinux. My impression is that KernelCare offers a more complete livepatching service. In addition, it also offers livepatching of critical libraries, such as libc6 and openssl.