3 ms·

> On an up to date Ubuntu 24.04 So not very up to date, but I suppose mitigations haven't changed significantly upstream since then.

necubi 1y ago
24.04 is the most recent LTS (long term support) release; it's what users are meant to be running for anything important
- FirmwareBurner 1y ago
  [flagged]
- arghwhat 1y ago
  My point is that it is not representative of the current state of the kernel. The kernel has nothing to do with Ubuntu, its release schedule and LTS's. Distro LTS releases also often mean custom kernels, backports, hardware enablement, whatnot, which makes it a fork, so unless were analyzing Ubuntu security rather than Linux security, mainline should be used.
  - BoredPositron 1y ago
    Microcode updates have nothing to do with the kernel?
    - dboreham 1y ago
      Correct.
    - arghwhat 1y ago
      Mitigations are generally kernel workarounds, not microcode updates. Microcode updates provide some fixes or disable features, but all kernel efforts and why they specify the software at all is because of kernel mitigations.
blueflow 1y ago
Ubuntu 24.04 is the current LTS release. Our are you intending to say that Ubuntu, regardless of version, is not up to date? Edit: "LTS" added due to popular demand
- pdpi 1y ago
  You need a qualifier there — the latest Ubuntu release is 25.04, but 24.04 is the current LTS release.
  - razemio 1y ago
    It is up to date, with security patches and fixes. That is obviously what is relevant here. That is why the parent comment got down voted, since it is up to date in context of a security vulnerability. It should be even more secure, since new software versions might introduce unknown attack vectors.
- arghwhat 1y ago
  I am saying that any version of Ubuntu is not representative of the mainline kernel, which is what is relevant when it comes to analyzing current mitigations. Distro LTS releases often mean custom kernels, backports, hardware enablement, whatnot, which makes it effectively a fork. Unless were interested in discovering kernel variation discrepancies, its more interesting to analyze mainline.
  - fc417fc802 1y ago
    I'd expect an awful lot of production workloads to be running on LTS kernel versions (and likely also LTS distro releases). So the mitigations currently available in an LTS release of a mainstream distro are quite relevant.
    - arghwhat 1y ago
      They are running their LTS distro's LTS kernel, but that us not an upstream thing On an LTS, you'll be running a Canonical kernel, or a Red Hat kernel, or a SuSE kernel, or an Oracle kernel, or... Each will have different backports, different hardware enablement, different random patches of choice, and so different bugs and problems. Unless were evaluating the security of a particular distro release, mainline is what is Linux and will ultimately be the shared base for future releases.
thomasdziedzic 1y ago
That version is significant because it is the latest LTS release. Most servers use LTS releases.
fwip 1y ago
24.04 is an LTS (long term support) release, so it receives updates, including security updates, for much longer than a regular release. I believe it's a 5-year support window, and longer if you shell out for paid support.
- arghwhat 1y ago
  These updates mean that you are no longer running a mainline kernel, but an Ubuntu fork with whatever backports and hardware enablement (and new bugs!) this might introduce. This is also true for other software. LTS does not mean you get all updates, it only means you get to drag your feet for longer with random bugfixes. Only the latest release has updates.
  - anyfoo 1y ago
    This only matters if the mainline kernel since then somehow experienced changes which would affect this hardware vulnerability (fixed through microcode), which I see no indication of?
    - arghwhat 1y ago
      CPU vulnerabilities are first fixed through kernel mitigations, only sometimes through microcode. But security research should be done against the current state. Something as simple as a performance optimization can end up affecting the exploitability, and while that doesn't change whether the CPU is vulnerable it does change the conclusion. Evaluering if a particular old, forked codebase is security-wise is identical is a fools errand, and then that doesn't answer whether an equivalent Red Hat kernel is vulnerable as that's a different fork with different backports and local patches. Mainline is the shared base.
      - anyfoo 1y ago
        I don’t quite understand how that matters here. The researchers found a CPU vulnerability. They demonstrated it on a popular Linux distribution and LTS version, Ubuntu 24.04. They likely picked that to show that the attack is not purely theoretical, but feasible on something that real users currently use for real things. There is a microcode fix available that solves this problem, presumably across all OSes and releases. Whether the kernel is current and how much it diverges is, frankly, irrelevant.
7bit 1y ago
There is a difference between an up2date Ubuntu 24.04 and an up2date Ubuntu. And as security updates are back ported to all supported versions - and 24.04 being an LTS release, it is as up2date as it gets. If you're being pedantic, be the right kind of pedantic ;)
- arghwhat 1y ago
  The problem is that it's downstream backports and hardware enablement - you're running an old forked artisinal kernel maintained by Canonical, you will only get bugfixes if known to be severe enough to be flagged, and all this patching deviates it from mainline and can itself introduce new security vulnerabilities not present in mainline. This differs from an actual later release which is closer to mainline and includes all newer fixes, including ones that are important but weren't flagged, and with less risk of having new downstream bugs. If you're going to fight pedantism by being pedantic, better be the right kind of pedantic. ;)

necubi 1y ago

24.04 is the most recent LTS (long term support) release; it's what users are meant to be running for anything important

FirmwareBurner 1y ago
[flagged]
arghwhat 1y ago
My point is that it is not representative of the current state of the kernel. The kernel has nothing to do with Ubuntu, its release schedule and LTS's. Distro LTS releases also often mean custom kernels, backports, hardware enablement, whatnot, which makes it a fork, so unless were analyzing Ubuntu security rather than Linux security, mainline should be used.
- BoredPositron 1y ago
  Microcode updates have nothing to do with the kernel?
  - dboreham 1y ago
    Correct.
  - arghwhat 1y ago
    Mitigations are generally kernel workarounds, not microcode updates. Microcode updates provide some fixes or disable features, but all kernel efforts and why they specify the software at all is because of kernel mitigations.

blueflow 1y ago

Ubuntu 24.04 is the current LTS release. Our are you intending to say that Ubuntu, regardless of version, is not up to date? Edit: "LTS" added due to popular demand

pdpi 1y ago
You need a qualifier there — the latest Ubuntu release is 25.04, but 24.04 is the current LTS release.
- razemio 1y ago
  It is up to date, with security patches and fixes. That is obviously what is relevant here. That is why the parent comment got down voted, since it is up to date in context of a security vulnerability. It should be even more secure, since new software versions might introduce unknown attack vectors.
arghwhat 1y ago
I am saying that any version of Ubuntu is not representative of the mainline kernel, which is what is relevant when it comes to analyzing current mitigations. Distro LTS releases often mean custom kernels, backports, hardware enablement, whatnot, which makes it effectively a fork. Unless were interested in discovering kernel variation discrepancies, its more interesting to analyze mainline.
- fc417fc802 1y ago
  I'd expect an awful lot of production workloads to be running on LTS kernel versions (and likely also LTS distro releases). So the mitigations currently available in an LTS release of a mainstream distro are quite relevant.
  - arghwhat 1y ago
    They are running their LTS distro's LTS kernel, but that us not an upstream thing On an LTS, you'll be running a Canonical kernel, or a Red Hat kernel, or a SuSE kernel, or an Oracle kernel, or... Each will have different backports, different hardware enablement, different random patches of choice, and so different bugs and problems. Unless were evaluating the security of a particular distro release, mainline is what is Linux and will ultimately be the shared base for future releases.

thomasdziedzic 1y ago

That version is significant because it is the latest LTS release. Most servers use LTS releases.

fwip 1y ago

24.04 is an LTS (long term support) release, so it receives updates, including security updates, for much longer than a regular release. I believe it's a 5-year support window, and longer if you shell out for paid support.

arghwhat 1y ago
These updates mean that you are no longer running a mainline kernel, but an Ubuntu fork with whatever backports and hardware enablement (and new bugs!) this might introduce. This is also true for other software. LTS does not mean you get all updates, it only means you get to drag your feet for longer with random bugfixes. Only the latest release has updates.
- anyfoo 1y ago
  This only matters if the mainline kernel since then somehow experienced changes which would affect this hardware vulnerability (fixed through microcode), which I see no indication of?
  - arghwhat 1y ago
    CPU vulnerabilities are first fixed through kernel mitigations, only sometimes through microcode. But security research should be done against the current state. Something as simple as a performance optimization can end up affecting the exploitability, and while that doesn't change whether the CPU is vulnerable it does change the conclusion. Evaluering if a particular old, forked codebase is security-wise is identical is a fools errand, and then that doesn't answer whether an equivalent Red Hat kernel is vulnerable as that's a different fork with different backports and local patches. Mainline is the shared base.
    - anyfoo 1y ago
      I don’t quite understand how that matters here. The researchers found a CPU vulnerability. They demonstrated it on a popular Linux distribution and LTS version, Ubuntu 24.04. They likely picked that to show that the attack is not purely theoretical, but feasible on something that real users currently use for real things. There is a microcode fix available that solves this problem, presumably across all OSes and releases. Whether the kernel is current and how much it diverges is, frankly, irrelevant.

7bit 1y ago

There is a difference between an up2date Ubuntu 24.04 and an up2date Ubuntu. And as security updates are back ported to all supported versions - and 24.04 being an LTS release, it is as up2date as it gets. If you're being pedantic, be the right kind of pedantic ;)

arghwhat 1y ago
The problem is that it's downstream backports and hardware enablement - you're running an old forked artisinal kernel maintained by Canonical, you will only get bugfixes if known to be severe enough to be flagged, and all this patching deviates it from mainline and can itself introduce new security vulnerabilities not present in mainline. This differs from an actual later release which is closer to mainline and includes all newer fixes, including ones that are important but weren't flagged, and with less risk of having new downstream bugs. If you're going to fight pedantism by being pedantic, better be the right kind of pedantic. ;)