Public bug reported:
Unattended upgrades is breaking systems until reboot whenever GPU driver
CVEs are delivered.
## Root cause:
* NVIDIA always forces ABI incompatibility between driver and userspace, even
when it's theoretically avoidable. A different userspace version will always
fail to run against a the wrong kernel module version.
* Whenever an unattended-upgrade occurs, both the userspace and the kerne are
updated. But the userspace is made available immediately, whereas the kernel
will only run on the next boot.
## Effect:
Machines will be unattendedly broken, until the user reboots it.
## Solutions:
### 1. Short term: an unattended-upgrade blacklist.
We tested the following solution on machines that comes with a -nvidia driver.
```
$ cat /etc/apt/apt.conf.d/30-blacklist-kernel-and-gpu-driver
Unattended-Upgrade::Package-Blacklist {
"linux-nvidia";
"linux-modules-";
"linux-signatures-";
"nvidia-driver-";
"nvidia-dkms-";
"nvidia-kernel-common-";
"libnvidia-common-";
"linux-headers-";
"linux-image-";
"linux-tools-";
};
```
It correctly prevent the unattended-upgrades to upgrade the GPU or driver.
However:
1.1 This is incomplete, because it only covers the linux-nvidia driver.
linux-generic should also be covered.
1.2 It requires to be reviewed and discussed by the kernel team and the
security team.
### 2. Long term: delaying the installation of the driver userspace.
There were discussions about making the userspace driver only be
available after the next reboot. Different technical implementations can
be considered, this must be discussed with Foundations.
** Affects: ubuntu
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161085
Title:
Unattended upgrades are breaking systems with NVIDIA GPUs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/2161085/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
