[Oraclevm-errata] New xen-tools updates available via Ksplice (OVMSA-2021-0014)

[Errata Announcements for Oracle VM]

Synopsis: OVMSA-2021-0014 can now be patched using Ksplice
CVEs: CVE-2020-29480 CVE-2020-29481 CVE-2020-29483 CVE-2020-29484

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle VM Security Fix Advisory, OVMSA-2021-0014.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y user upgrade

Ksplice Xen-tools patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* Note: Oracle will not provide an update for CVE-2020-29480, XSA-115.

CVE-2020-29480, XSA-115 is an information leak in the xenstored daemon.
A malicious guest administrator could use this flaw to leak information
about other guests running on the system. Oracle recommends upgrading
xen-tools and restarting xenstored daemon on affected machines.


* Note: Oracle will not provide an update for CVE-2020-29481, XSA-322.

CVE-2020-29481, XSA-322 could lead to an information leak when a guest
is destroyed and a new one is created with the same domain id. Oracle
recommends upgrading xen-tools and restarting xenstored daemon on
affected machines.


* Note: Oracle will not provide an update for CVE-2020-29483, XSA-325.

CVE-2020-29483, XSA-325 is a denial-of-service when stub domain are
used. Oracle recommends upgrading xen-tools and restarting xenstored
daemon on affected machines.


* CVE-2020-29484, XSA-324: Denial-of-service when processing watch events in xenstore.

A missing check in xenstore watch events processing could lead to a NULL
pointer dereference. A malicious guest could use this flaw to cause a
denial-of-service.

Orabug: 32222999


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.