[Oraclevm-errata] New xen updates available via Ksplice (4.4.4-222.0.14.el6)

[Errata Announcements for Oracle VM]

Synopsis: 4.4.4-222.0.14.el6 can now be patched using Ksplice
CVEs: CVE-2019-11135 CVE-2019-19583

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle kernel update, 4.4.4-222.0.14.el6.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* CVE-2019-19583, XSA-308: Denial-of-service on VM entry when CPU is in particular state.

An incorrect handling of Debug exception when the cpu has single stepping
and STI/MovSS active could lead to a guest crash. A local attacker
could use this flaw to cause a denial-of-service.

Orabug: 30604094


* CVE-2019-11135, XSA-305: Side-channel information leak in Intel TSX.

A side-channel information leak on some generations of Intel processors
could allow the leaking of internal microarchitectural buffers during
asynchronous aborts in a TSX transaction.  For CPUs that are vulnerable
to Microarchitectural Data Sampling, existing mitigations cover
CVE-2019-11135, for newer CPUs with hardware fixes for MDS, TSX is
transparently disabled.

Orabug: 30604160


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.