[Oraclevm-errata] New xen updates available via Ksplice (4.4.4-222.0.24.el6)

[Errata Announcements for Oracle VM]

Synopsis: 4.4.4-222.0.24.el6 can now be patched using Ksplice
CVEs: CVE-2020-15565 CVE-2020-15567

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle kernel update, 4.4.4-222.0.24.el6.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* CVE-2020-15567, XSA-328: Privilege escalation when setting up nested paging on Intel hardware.

Non-atomic operations when setting up the nested paging page table entries
could expose physical frame memory that would otherwise be non-accessible.
A guest use this flaw to escalate privileges.

Orabug: 31545484


* CVE-2020-15565, XSA-321: Privilege escalation with shared page tables between CPU and IOMMU.

A lack of proper synchronization between the writign back of CPU caches,
CPU Table Lookaside Buffers (TLB) and Input Output Memory Management Unit
(IOMMU) TLBs flushing when modifying page tables that are shared between
the CPU and the IOMMU could leave physical memory readable and writable
through DMA operations.  A guest could use this flaw to read otherwise
protected memory or escalate privileges.

Orabug: 31545450


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.