{
  "id": "CB-UBU-PKG-013",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-PKG-013",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-PKG-013.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-PKG-013.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-PKG-013",
    "title": "Reboot after updates that require it, or use Livepatch",
    "finding": {
      "title": "The system has waited too long for a reboot that updates require",
      "description": "Updated kernel or core libraries are installed but not running, so the vulnerabilities they fix are still exploitable."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "updates",
      "reboot",
      "livepatch"
    ],
    "description": "Some updates only take effect after a reboot: the kernel, and libraries loaded by every\nprocess such as the C library, OpenSSL or systemd. When a package asks for it,\n`update-notifier-common` creates `/var/run/reboot-required` and lists the packages concerned in\n`/var/run/reboot-required.pkgs`. Both files disappear at the next boot (`/var/run` is a tmpfs).\n\nCanonical Livepatch, part of Ubuntu Pro, applies the fixes for high and critical kernel\nvulnerabilities to the running kernel without a reboot.\n\nThe control fails when `/var/run/reboot-required` is older than `{{ max_days }}` days, unless\nevery package that asked for the reboot is a kernel package (`linux-*`) and Livepatch is\nrunning and has applied its patches.\n",
    "rationale": "An updated package on disk does not protect the system while the old kernel or library is\nstill in memory: a scanner reading package versions reports the system as fixed while the\nvulnerability can still be exploited. Systems that are never rebooted are among the most\nfrequent audit findings. A bounded delay leaves time to plan the reboot in a maintenance\nwindow.\n",
    "impact": "Rebooting interrupts the services of the system: plan a regular maintenance window, or use\n`Unattended-Upgrade::Automatic-Reboot` with `Automatic-Reboot-Time` on systems that can reboot\non their own. Livepatch needs an Ubuntu Pro subscription and only covers the kernel.\n",
    "notes": "The control does not reboot the system: there is no automated fix. Long-running processes can\nalso keep old libraries mapped without any reboot-required file; `needrestart` (installed by\ndefault on 22.04 and later servers) restarts the services concerned after updates.\n",
    "setting": {
      "location": "/var/run/reboot-required, /var/run/reboot-required.pkgs",
      "recommended_value": "Absent, or at most {{ max_days }} days old, or only kernel packages with Livepatch applied"
    },
    "parameters": [
      {
        "name": "max_days",
        "type": "integer",
        "description": "Longest accepted delay between an update that requires a reboot and the reboot.",
        "unit": "days",
        "default": 14,
        "profile_defaults": {
          "server-hardened": 7,
          "desktop-hardened": 7
        },
        "minimum": 1,
        "maximum": 90
      }
    ],
    "audit": {
      "manual": "1. `ls -l --time-style=+%F /var/run/reboot-required` shows no file, or a date at most\n   `{{ max_days }}` days ago.\n2. Otherwise, `cat /var/run/reboot-required.pkgs` lists only `linux-*` packages and\n   `canonical-livepatch status` shows Livepatch running with its patches applied.\n",
      "checks": [
        {
          "id": "reboot-required",
          "engine": "shell",
          "description": "Age of /var/run/reboot-required, packages that asked for the reboot, and Livepatch state.",
          "spec": {
            "script": "f=/var/run/reboot-required\n[ -e \"$f\" ] || { echo \"no reboot required\"; exit 0; }\nage=$(( ($(date +%s) - $(stat -c %Y \"$f\")) / 86400 ))\npkgs=$(sort -u \"$f.pkgs\" 2>/dev/null | tr '\\n' ' ')\necho \"reboot required for $age days (limit $CB_MAX_DAYS) by: ${pkgs:-unknown packages}\"\n[ \"$age\" -le \"$CB_MAX_DAYS\" ] && exit 0\nif [ -n \"$pkgs\" ] && [ -z \"$(sort -u \"$f.pkgs\" | grep -v '^linux-')\" ]; then\n  lp=/snap/bin/canonical-livepatch\n  if [ -x \"$lp\" ] && \"$lp\" status --format=json 2>/dev/null | grep -Eiq '\"patchState\": ?\"(applied|nothing-to-apply)\"'; then\n    echo \"kernel updates only, covered by Livepatch\"\n    exit 0\n  fi\n  echo \"kernel updates only, Livepatch not running or not applied\"\nfi\nexit 1\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Reboot the system during a maintenance window (`systemctl reboot`), then check that\n`/var/run/reboot-required` is gone. To keep up without a human:\n\n- schedule the reboot with unattended-upgrades on systems that can reboot unattended, in\n  `/etc/apt/apt.conf.d/52unattended-upgrades-local`:\n  `Unattended-Upgrade::Automatic-Reboot \"true\";` and\n  `Unattended-Upgrade::Automatic-Reboot-Time \"03:00\";`;\n- on systems attached to Ubuntu Pro, enable Livepatch (`pro enable livepatch`) to defer kernel\n  reboots, and still reboot for the other packages.\n"
    },
    "references": [
      {
        "title": "Ubuntu Server documentation - Automatic updates",
        "url": "https://documentation.ubuntu.com/server/how-to/software/automatic-updates/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "unattended-upgrade(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/unattended-upgrade.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Canonical Livepatch",
        "url": "https://ubuntu.com/security/livepatch",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Canonical Livepatch documentation",
        "url": "https://ubuntu.com/security/livepatch/docs",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R61",
        "relation": "partial",
        "note": "R61 asks for a regular update process; this control checks that installed fixes are actually running."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-2",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1068"
      },
      {
        "framework": "mitre-attack",
        "id": "T1190"
      },
      {
        "framework": "cwe",
        "id": "CWE-1395"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-PKG-007",
        "type": "related"
      },
      {
        "id": "CB-UBU-PKG-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on stock; reboot-required 20 days old for libc6 fails (14 days core), 8 days old for linux-* fails with 7 days (hardened) and passes with a stub canonical-livepatch reporting patchState applied (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on stock; reboot-required 20 days old for libc6 fails (14 days core), 8 days old for linux-* fails with 7 days (hardened) and passes with a stub canonical-livepatch reporting patchState applied (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on stock; reboot-required 20 days old for libc6 fails (14 days core), 8 days old for linux-* fails with 7 days (hardened) and passes with a stub canonical-livepatch reporting patchState applied (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on stock; reboot-required 20 days old for libc6 fails (14 days core), 8 days old for linux-* fails with 7 days (hardened) and passes with a stub canonical-livepatch reporting patchState applied (no Pro token in the lab)."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}