LSN-120-1: Ubuntu Kernel Live Patch Security Advisory — CVE Analysis and Remediation Guide

---
title: Ubuntu Kernel Module Load from Suspicious Directory
id: 4f8e2d1a-7c3b-4a5f-9e0d-2b1c3a4d5e6f
status: experimental
description: Detects potential kernel exploitation attempts via loading kernel modules from suspicious directories related to LSN-120-1
references:
  - https://ubuntu.com/security/notices/LSN-120-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1547.006
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/usr/sbin/insmod'
      - '/usr/sbin/modprobe'
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection
falsepositives:
  - Legitimate kernel module testing
level: high
---
title: Ubuntu Live Patch Status Check
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects Ubuntu Live Patch status checks that may indicate LSN-120-1 patch verification
references:
  - https://ubuntu.com/security/notices/LSN-120-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/snap/bin/canonical-livepatch'
    CommandLine|contains: 'status'
  condition: selection
falsepositives:
  - Routine Live Patch monitoring
level: low
---
title: Ubuntu Kernel Version Check
id: 9a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects kernel version checks on Ubuntu systems that may be related to LSN-120-1 vulnerability assessment
references:
  - https://ubuntu.com/security/notices/LSN-120-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/usr/bin/uname'
    CommandLine|contains: '-r'
  timeframe: 1h
  condition: selection
falsepositives:
  - System administration activities
level: low

// Detect Ubuntu systems checking kernel versions - potential LSN-120-1 monitoring
Syslog
| where SyslogMessage contains "uname" and SyslogMessage contains "-r"
| project TimeGenerated, Computer, SyslogMessage, ProcessName
| summarize Count() by Computer, bin(TimeGenerated, 1h)
// Check for Live Patch status checks
| union (
    Syslog
    | where SyslogMessage contains "livepatch" or SyslogMessage contains "canonical-livepatch"
    | project TimeGenerated, Computer, SyslogMessage, ProcessName
)

-- Check for Ubuntu kernel version and live patch status
SELECT OS, Fqdn, KernelVersion, Uname
FROM info()
WHERE OS =~ "linux"
-- Check for live patch status
SELECT *
FROM execve(argv=["/snap/bin/canonical-livepatch", "status"])
-- Check for kernel modules loaded
SELECT Name, Size, UsedBy
FROM kernel_modules()
WHERE Name =~ "livepatch"

#!/bin/bash
# Ubuntu Kernel Live Patch Verification and Remediation Script
# Addresses LSN-120-1 vulnerabilities

echo "Checking Ubuntu Kernel Live Patch status..."

# Check if canonical-livepatch is installed
if ! command -v canonical-livepatch &> /dev/null; then
    echo "ERROR: canonical-livepatch is not installed"
    echo "Installing canonical-livepatch..."
    sudo snap install canonical-livepatch
    echo "Please configure your Live Patch token and run this script again"
    exit 1
fi

# Check Live Patch status
echo "Current Live Patch status:"
canonical-livepatch status

# Get current kernel version
echo "Current kernel version:"
uname -r

# Check for available patches
echo "Checking for available kernel live patches..."
canonical-livepatch refresh

# Verify patches are applied
echo "Verifying patch application..."
canonical-livepatch status --verbose

echo "Remediation complete. Please review the output above to confirm patches are applied."