[Oraclevm-errata] New xen updates available via Ksplice (4.4.4-222.0.38.el6)

[Errata Announcements for Oracle VM]

Synopsis: 4.4.4-222.0.38.el6 can now be patched using Ksplice
CVEs: CVE-2020-25595 CVE-2020-25597 CVE-2020-25599 CVE-2020-25600 CVE-2020-25601 CVE-2020-25603 CVE-2020-25604 CVE-2020-27671 CVE-2020-27672 CVE-2020-28368 CVE-2020-29570

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle kernel update, 4.4.4-222.0.38.el6.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

This hypervisor release does not contain software mitigations for some
important security fixes.  We recommend planning an upgrade to install the
latest Xen hypervisor to benefit from all of the important security fixes.

DESCRIPTION

* Note: Oracle will not provide an update for CVE-2020-25604, XSA-336.


CVE-2020-25604, XSA-336 is a race condition when migrating timers
between HVM cpus which could lead to a denial-of-service. Systems where
untrusted guests are used should reboot into a newer Xen version.

Orabug: 31864999


* CVE-2020-25595, XSA-337: Denial-of-service when using PCI Passthrough.

A logic error in handling of MSI could lead to an invalid memory access.
A not fully trusted guest could use this flaw to cause a denial-of-service.
Note that guests using PCI passthrough devices before the update is
applied could still cause a denial-of-service.

Orabug: 31865021


* Note: Oracle will not provide a zero downtime update for CVE-2020-25597, XSA-338.

CVE-2020-25597, XSA-338 is a logic error in the event channel code
triggering a hypervisor assert and leading to a denial-of-service.
Systems where untrusted guests are used should reboot into a newer Xen
version.

Orabug: 31865047


* Note: Oracle will not provide a zero downtime update for CVE-2020-25603, XSA-340.

A compiler optimization in the event channel driver could lead to use-after-free
and a denial-of-service. Systems where untrusted guests are used should
reboot into a newer Xen version.

Orabug: 31865104


* CVE-2020-25600, XSA-342: Denial-of-service when using event channel with 32 bits domains.

A logic error when using event channel with 32 bits domains could lead
to an out-of-bounds access. A guest could use this flaw to cause a
denial-of-service.

Orabug: 31865129


* Note: Oracle will not provide a zero downtime update for CVE-2020-25599, XSA-343.

CVE-2020-25599, XSA-343 could lead to privileges escalation or
denial-of-service when x86 PV guests are used. Systems where untrusted
PV guests are used should reboot into a newer Xen version.

Orabug: 31865142


* Note: Oracle will not provide an update for CVE-2020-25601, XSA-344.

CVE-2020-25601, XSA-344 could lead to a denial-of-service,  systems
where untrusted guests are used should reboot into a newer Xen version.

Orabug: 31865158


* CVE-2020-27672, XSA-345: Use-after-free during memory management operations.

A race condition during memory management operations on hypervisor side
could let a malicious guest trigger a use-after-free by doing
precisely-timed actions.

Orabug: 31984388


* CVE-2020-27671, XSA-346, XSA-355: Information leak when handling physical to machine address mappings.

A logic error when handling physical to machine address mappings could
let a guest leak information about other guests or hypervisor.

Orabug: 31984408


* CVE-2020-28368, XSA-351: Information leak using side channel attack.

A too permissive access to interface used to sample power/energy data of
the processor could let an attacker leak information like cryptographic
keys.

Orabug: 32176091


* CVE-2020-29570, XSA-358: Denial-of-service in FIFO event channel.

A logic error in FIFO event channel driver could let a guest cause a
denial-of-service.

Orabug: 32223369


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.