[El-errata] New Ksplice updates for UEKR4 4.1.12 on OL6 and OL7 (ELSA-2019-4669)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2019-4669 can now be patched using Ksplice
CVEs: CVE-2017-7308 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-14634 CVE-2019-11091

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2019-4669.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2019-4669.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR4 4.1.12 on
OL6 and OL7 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* Improved update to CVE-2019-11091, CVE-2018-12126, CVE-2018-12130, CVE-2018-12127: Microarchitectural Data Sampling.

The previous kernel mitigation for MDS did not correctly flush the
microarchitectural buffers on return to user-space, potentially leaving the
system vulnerable.


* Spectre v2 bypass with EIBRS support and unconditional SSBD Spectre v4 mitigation.

Multiple logic errors could cause EIBRS to be disabled on new CPUs with
EIBRS support and the kernel booted with spec_store_bypass_disable=on
for SSBD control.


* Spectre v4 SSBD setting failure for KVM guests.

If SSBD was disabled on the host, guest toggling of the SSBD state would
be transparently dropped resulting in Spectre v4 vulnerability for the
guest.

Orabug: 29423804


* Incorrect Meltdown mitigation reporting for HVM Xen guests.

A logic error when determining the Xen guest type could incorrectly
report a Xen HVM guest as being vulnerable to Meltdown when it was
already mitigated.


* Transparent hugepage performance degradation under low-memory conditions.

A suboptimal heuristic could result in thrashing when allocating
transparent hugepages when the local NUMA node was under low memory
conditions.

Orabug: 29510356

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.