[Oraclevm-errata] New xen updates available via Ksplice (OVMSA-2021-0033)

[Errata Announcements for Oracle VM]

Synopsis: OVMSA-2021-0033 can now be patched using Ksplice
CVEs: CVE-2021-28694 CVE-2021-28697 CVE-2021-28698 CVE-2021-28701

Users with Oracle VM Premier Support can now use Ksplice to patch
against the latest Oracle VM Security Fix Advisory, OVMSA-2021-0033.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OVM 3.4 install these
updates.

You can install these updates by running:

# ksplice -y xen upgrade

Ksplice Xen patching requires installation of Ksplice-aware packages and the
system must be rebooted after the first installation of these packages.  Refer
to the installation instructions for the Enhanced Ksplice Client in the Ksplice
User's Guide for more details.  Systems may be prepared for Ksplice patching by
installing the Ksplice aware packages in advance, prior to installing the
enhanced Ksplice client.

DESCRIPTION

* XSA-378, CVE-2021-28694: Privilege escalation, information leak and denial-of-service with specific ACPI tables configuration.

Usage of discontinuous memory zones in the ACPI table could let a guest
with physical device access escalate privileges, leak sensitive
information or cause a denial-of-service.

Orabug: 33215714


* XSA-379, XSA-384, CVE-2021-28697, CVE-2021-28701: Privilege escalation when using grant table v2.

Multiple error in the way grant table v2 pages are handled could lead to
reusing pages across guests.  A local guest could use this flaw to
denial-of-service, an information leak or a privilege escalation.

Orabug: 33215748


* XSA-380, CVE-2021-28698: Denial-of-service when handling grant mappings.

A too important number of grant mappings for a domain could make the
hypervisor taking too much time handling it and holding the CPU for too
long. A malicious guest could use this flaw to cause a
denial-of-service.

Orabug: 33215771


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.