[Oraclevm-errata] New xen updates available via Ksplice (OVMSA-2022-0012)

[Errata Announcements for Oracle VM]

Synopsis: OVMSA-2022-0012 can now be patched using Ksplice
CVEs: CVE-2022-26356 CVE-2022-26357

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle VM Security Fix Advisory, OVMSA-2022-0012.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* CVE-2022-26356: Memory leak in dirty vram tracking.

A race between ditry vram tracking and log dirty hypercalls can result
in a memory leak.  This flaw could be exploited by a malicious local
user to waste system resources, potentially resulting in a
denial-of-service.

Orabug: 34038131


* CVE-2022-26357: Information leak during VT-d domain ID cleanup.

A race condition during VT-d domain ID cleanup could be exploited by a
local attacker to leak domain IDs and bypass flushes.

Orabug: 34038182


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.