[Oraclevm-errata] OVMSA-2017-0159 Important: Oracle VM 3.2 xen security update

[Errata Announcements for Oracle VM]

Oracle VM Security Advisory OVMSA-2017-0159

The following updated rpms for Oracle VM 3.2 have been uploaded to the 
Unbreakable Linux Network:

x86_64:
xen-4.1.3-25.el5.223.86.x86_64.rpm
xen-devel-4.1.3-25.el5.223.86.x86_64.rpm
xen-tools-4.1.3-25.el5.223.86.x86_64.rpm


SRPMS:
http://oss.oracle.com/oraclevm/server/3.2/SRPMS-updates/xen-4.1.3-25.el5.223.86.src.rpm



Description of changes:

[4.1.3-25.el5.223.86]
- The code of OVM3.2.9 is quite old, there is no get_page/put_page pair 
to protect
   the ownership and references of page table page which is mapped in
   emulate_map_dest().
   This patch fix it by adding get_page() in emulate_gva_to_mfn() to match
   put_page() in xsa219-4.5.patch so that it works.
   Signed-off-by: Zhenzhong Duan <zhenzhong.duan at oracle.com>
   Reviewed-by: Boris Ostrovsky <boris.ostrovsky at oracle.com> [bug 26816043]

[4.1.3-25.el5.223.85]
- From: Jan Beulich <jbeulich at suse.com>
   Subject: gnttab: also validate PTE permissions upon destroy/replace
   In order for PTE handling to match up with the reference counting done
   by common code, presence and writability of grant mapping PTEs must
   also be taken into account; validating just the frame number is not
   enough. This is in particular relevant if a guest fiddles with grant
   PTEs via non-grant hypercalls.
   Note that the flags being passed to replace_grant_host_mapping()
   already happen to be those of the existing mapping, so no new function
   parameter is needed.
   This is XSA-234.
   Signed-off-by: Jan Beulich <jbeulich at suse.com>
   Reviewed-by: Andrew Cooper <andrew.cooper3 at citrix.com>
   Backported-by: Zhenzhong Duan <zhenzhong.duan at oracle.com>
   Reviewed-by: Boris Ostrovsky <boris.ostrovsky at oracle.com> [bug 26721589]

[4.1.3-25.el5.223.84]
- From: Juergen Gross <jgross at suse.com>
   Subject: tools/xenstore: dont unlink connection object twice
   A connection object of a domain with associated stubdom has two
   parents: the domain and the stubdom. When cleaning up the list of
   active domains in domain_cleanup() make sure not to unlink the
   connection twice from the same domain. This could happen when the
   domain and its stubdom are being destroyed at the same time leading
   to the domain loop being entered twice.
   Additionally don't use talloc_free() in this case as it will remove
   a random parent link, leading eventually to a memory leak. Use
   talloc_unlink() instead specifying the context from which the
   connection object should be removed.
   This is XSA-233.
   Signed-off-by: Juergen Gross <jgross at suse.com>
   Reviewed-by: Ian Jackson <ian.jackson at eu.citrix.com>
   Backported-by: Zhenzhong Duan <zhenzhong.duan at oracle.com>
   Reviewed-by: Boris Ostrovsky <boris.ostrovsky at oracle.com> [bug 26721577]

[4.1.3-25.el5.223.83]
- From: George Dunlap <george.dunlap at citrix.com>
   Subject: xen/mm: make sure node is less than MAX_NUMNODES
   The output of MEMF_get_node(memflags) can be as large as nodeid_t can
   hold (currently 255).  This is then used as an index to arrays of size
   MAX_NUMNODE, which is 64 on x86 and 1 on ARM, can be passed in by an
   untrusted guest (via memory_exchange and increase_reservation) and is
   not currently bounds-checked.
   Check the value in page_alloc.c before using it, and also check the
   value in the hypercall call sites and return -EINVAL if appropriate.
   Don't permit domains other than the hardware or control domain to
   allocate node-constrained memory.
   This is XSA-231.
   Signed-off-by: George Dunlap <george.dunlap at citrix.com>
   Signed-off-by: Jan Beulich <jbeulich at suse.com>
   Reviewed-by: Andrew Cooper <andrew.cooper3 at citrix.com>
   Conflict:
   xen/common/memory.c
   Use IS_PRIV() instead of is_hardware_domain() and is_control_domain() in
   original patch.
   Backported-by: Zhenzhong Duan <zhenzhong.duan at oracle.com>
   Reviewed-by: Boris Ostrovsky <boris.ostrovsky at oracle.com> [bug 26721505]