[Oraclevm-errata] New xen updates available via Ksplice (OVMSA-2021-0020)

[Errata Announcements for Oracle VM]

Synopsis: OVMSA-2021-0020 can now be patched using Ksplice
CVEs: CVE-2021-0089 CVE-2021-26313 CVE-2021-28690 CVE-2021-28692

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle VM Security Fix Advisory, OVMSA-2021-0020.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* Note Oracle will not provide an update for CVE-2021-28692, XSA-373.

CVE-2021-28692, XSA-373 is a privilege escalation in the IOMMU driver.
Oracle recommends customers using x86 guests, with physical devices
passed through to them, upgrading Xen hypervisor.

Orabug: 32929926


* CVE-2021-26313, CVE-2021-0089, XSA-375: Information leak when self-modifying code is in use.

Xen is using self-modifying code intensively on x86 and recent CPUs have
microarchitectural behavior where the stale instruction stream can still
be speculatively executed. A local attacker could use this flaw to leak
information about the hypervisor and other running guests. 

Orabug: 32929996


* CVE-2021-28690, XSA-377: Side-channel information leak in Intel TSX after S3 resume.

A missing CPU configuration after CPU exit from S3 power state could
allow the leaking of internal microarchitectural buffers during
asynchronous aborts in a TSX transaction.

Orabug: 32930013


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.