XEN Security Update XSA-213/214/215, CVE-2017-8903/8904/8905

Issue	Summary	Affected Versions				Fixed
		Static Compute Resources		CloudBoot Compute Resources		Static Compute Resources		CloudBoot Compute Resources
		CentOS 5.x	CentOS 6.x	CentOS 5.x	CentOS 6.x	CentOS 5.x	CentOS 6.x	CentOS 5.x	CentOS 6.x
XSA-213/CVE-2017-8903	X86: 64bit PV guest breakout via pagetable use-after-mode-change	✓*	✓*	✓*	✓*	-	✓**	-	✓
XSA-214/CVE-2017-8904	Grant transfer allows PV guest to elevate priviliges	✓	✓	✓	✓	✓	✓**	✓	✓
XSA-215/CVE-2017-8905	Possible memory corruption via failsafe callback	✓*	✓*	✓*	✓*	✓	✓**	✓	✓

* Both Static and CloudBoot compute resources running both under CentOS 5.x and 6.x are affected. Those running Linux x86_64 guests are vulnerable.

** The issue has been fixed for OnApp versions 4.2.0 and up for CentOS 6.x with Xen 4.4.4.

Static Compute Resources

For customers willing to upgrade to the latest compute resource tools (corresponding to OnApp version installed)

This step applies to CentOS 5.x Xen compute resources only. Run the following command:
1
# yum update onapp-hv-install
Be aware that centos.org has stopped the support of CentOS 5.x.

Run the OnApp Xen Compute Resource installer

1
# /onapp/onapp-hv-install/onapp-hv-xen-install.sh

For customers which are using latest compute resource tools or do not want to upgrade them:

CentOS 5.x
1
# yum update xen xen-libs
This should update to the 3.4.4-35.el5.onapp version.
Be aware that centos.org has stopped the support of CentOS 5.x.
CentOS 6.x
1
# yum update xen xen-hypervisor
For versions of OnApp HV tools after version 4.2.0 the fix is provided by CentOS.org. The command above should update to the 4.4.4-23 version.
Reboot all compute resources.

To eliminate the security issue for Cloudboot Compute Resources, see CloudBoot Compute Resources and CloudBoot Backup Server upgrade procedures.

This should update to the following version:

CentOS 5	CentOS 6
`onapp-ramdisk-centos5-xen-5.4.0-21.noarch.rpm`	`onapp-ramdisk-centos6-xen-5.4.0-21.noarch.rpm`