Confirming a security patch actually landed: matching installed versions against vendor advisories across OS families

What it is

Every OS family publishes advisories that tie a specific CVE to a specific fixed package or build version: Ubuntu's USN-numbered notices (listed at ubuntu.com/security/notices), Red Hat-family advisories such as RHSAs (queryable on an installed system with dnf updateinfo list --security, whose --security filter "includes packages that provide a fix for a security issue"), Debian DSAs (cross-checked locally with debsecan, which "analyzes the list of installed packages on the current host and reports vulnerabilities found on the system"), Windows update history (Get-HotFix, which queries the Win32_QuickFixEngineering WMI class), and Apple's own security-release list at support.apple.com, which records the build/version pairing for every shipped update.

Verification means comparing what is actually installed against that advisory, not trusting that a patch job's exit code was zero.

Why it matters

An update tool can report success while still leaving the specific fix uninstalled — a repository pin, a held package, a failed dependency resolution, or (on Windows and Linux alike) an update that installed but needs a restart to take effect. "Patched" as a status is only as good as the last check that actually named the CVE or advisory and confirmed the fixed version is what's running.

How to apply

• Debian: run debsecan --suite <codename> --only-fixed (the man page requires the correct suite with --only-fixed) to list vulnerabilities for which a fixed package exists. debsecan uses Debian's security data, so it is not a check for Ubuntu; on Ubuntu, compare dpkg-query -W <package> with the fixed version named in the USN.
• RHEL 8 to 10 (DNF 4): dnf updateinfo list --security lists advisories for which a newer package is available (still outstanding), dnf updateinfo list --security --installed those already applied, and dnf updateinfo info <advisory-id> shows one advisory in detail. Fedora 41 and later use DNF 5, where the command is dnf advisory.
• Windows: Get-HotFix | Sort-Object InstalledOn -Descending lists updates serviced through Component-Based Servicing, cross-checked against the KB number in the release notes. It does not list updates installed by other mechanisms such as Windows Installer, and cumulative updates are identified most reliably by OS build: compare CurrentBuild and UBR under HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion with the build listed for the KB.
• macOS: compare sw_vers -productVersion (and -buildVersion) against the current build listed on Apple's security-releases page for that OS version line.
• On every OS, check whether a restart is still owed before declaring the fix live: dnf needs-restarting -r on RHEL 8 and later reports "whether a reboot is required" (exit code 1 means yes) and -s lists services to restart. On Debian/Ubuntu, packages that need a reboot create /var/run/reboot-required; unattended-upgrades reboots on its own only if Unattended-Upgrade::Automatic-Reboot is set to true (the default is false), and services using outdated libraries are handled by needrestart.

Pitfalls

• Trusting an update manager's own "up to date" message without naming the CVE or advisory the check was for.
• Confirming the package version changed but never confirming the running process (a long-lived daemon, a kernel) was restarted to pick it up.
• Comparing against a cached or stale advisory list; refresh metadata (apt update, dnf makecache, or reloading the advisory page) immediately before comparing.