[Oraclevm-errata] New xen updates available via Ksplice (OVMSA-2019-0016)
Errata Announcements for Oracle VM
oraclevm-errata at oss.oracle.com
Tue Jun 11 00:04:07 PDT 2019
Synopsis: OVMSA-2019-0016 can now be patched using Ksplice
CVEs: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091
Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle VM Security Fix Advisory, OVMSA-2019-0016.
INSTALLING THE UPDATES
We recommend that all users of Ksplice on OVM 3.4 install these
You can install these updates by running:
# ksplice -y xen upgrade
Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages. Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details. Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.
* XSA-297, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130, CVE-2018-12127: Microarchitectural Data Sampling.
A hardware vulnerability on various Intel x86 processors can allow a
process to speculatively access privileged information stored in CPU
microarchitectural buffers. A local user or guest VM could use this flaw
to learn information about the host kernel or hypervisor and use this to
facilitate a further attack.
Updated microcode is required for the mitigation to be effective.
Orabug: 2977162, 29677162
* XSA-284: Privilege escalation when processing grant table transfer requests.
An error in accounting allocated page when processing a grant table
transfer requests for a page with an address too large to be represented
in the interface with the guest could lead to a memory leak. An attacker
in a guest VM could use this flaw to exhaust hypervisor memory, leak
data from other guests or escalate privileges. Only HVM guests having
'machine_address_size' set in their guest config file could exploit this
Ksplice support is available at ksplice-support_ww at oracle.com.
More information about the Oraclevm-errata