How do I install the new BootHole update?

Question

I am new to Ubuntu and have 18.04. How do I install the new update to fix the BootHole vulnerability on my 18.04? What commands, process, etc., should I use?

Answer 1

Most folks don't need to do anything at all.

The Ubuntu Security Team has labored mightily to ensure that these CVEs can be fixed through normal security upgrades. For most folks, those occur automatically.

1. Ensure that you have the -security repository enabled for your release of Ubuntu. This is already enabled by default in all deb-based versions of Ubuntu. The following steps won't work without the -security repository enabled.

   • Related: How to enable the -security repository (most folks do not need this)

2. Unattended Upgrades is also enabled by default. If it's enabled, then you don't need to do anything. The fixes will be automatically downloaded and installed automatically.

3. If you have disabled Unattended Upgrades, or don't want to wait a couple hours, then an ordinary sudo apt update and sudo apt upgrade will install the fixes.

To check if you have already received the security upgrade is a simple two-step process:

1. Look at this table to determine your NEW package version.

   Example: on 20.04, the table says that the package grub-efi-amd64-bin is fixed with version 2.04-1ubuntu26.1

2. Query apt for the current installed version.

   Example: On 20.04, the current version according to apt:

    $ apt list grub-efi-amd64-bin
    Listing... Done
    grub-efi-amd64-bin/focal-updates,now 2.04-1ubuntu26.1 amd64 [installed,automatic]
   

   See how the version number matches the table? This system is already fixed (it was done by Unattended Upgrades automatically a few hours ago)

References:

• Security Team Blog Post on the Boothole vulnerabilities.

• Ubuntu Security Podcast Episode 84, a discussion from the Ubuntu Security Team of the vulnerability, how the fix works, and how the fix was coordinated across multiple distros.

• Ubuntu Wiki Page detailing the CVEs

• Ubuntu Security Notice for boothole, showing the fixed package versions.