Oracle Security Patch October 2013 has been released


On 15. October 2013 Oracle released the quarterly Security Patch for October 2013.

How to patch, see here.

At same time the following PSUs for Database and Clusterware/Grid Infrastructure has been released:

Unix/Linux Systems:

  • 12.1.0.1.0 PSU 1 (12.1.0.1.1)  (DB: 17027533, GI: 17272829)
    actual available for:
    • Linux x86-64
    • Solaris x86-64
    • Solaris SPARC (64Bit)
  • 11.2.0.3.0 PSU 8 (11.2.0.3.8)  (DB:  16902043, GI: 17272731)
  • 11.2.0.2.0 PSU 12 (11.2.0.2.12)  (DB:  17082367, GI: 17272753)
  • 11.1.0.7.0 PSU 16 (11.1.0.7.16) (DB:  17082366, CRS: 11724953)

Windows Systems:

For 10g Customers:

The PSU July 2013 was the final PSU for Oracle 10gR2 Database (10.2.0.4.0 & 10.2.0.5.0). So the final version is:

Unix/Linux

  • 10.2.0.5.0 PSU 12
  • 10.2.0.4.0 PSU 17

Windows

  • 10.2.0.5 BP 23 (32 Bit)
  • 10.2.0.5 BP 22 (64 Bit) (Maybe there will be a BP 23, Documentation is inconsistent)
  • 10.2.0.4 BP 50 (32 Bit)
  • 10.2.0.4 BP 49 (64 Bit) (Maybe there will be a BP 50, Documentation is inconsistent)

Common Vulnerabilities and Exposures (CVE) fixed in these patches:

  • CVE-2011-3389
  • CVE-2013-0169
  • CVE-2013-3762
  • CVE-2013-5766
  • CVE-2013-5827
  • CVE-2013-5828

Limitations:

  • Patch Set Update (PSU) patches are cumulative.
  • This patch is Oracle RAC Rolling Installable.
  • This patch is Data Guard Standby-First Installable.

IMPORTANT:
This patch contains a security fix due to which a SELECT query’s plan MAY change under the following conditions:

  • The SELECT queries a table protected with a Fined Grained Auditing policy
  • And the policy condition is NULL

Refer to My Support notice for more information:

  • Bug 17027533 – 12.1.0.1.1 (Oct 2013) Database Patch Set Update (PSU) [ID 17027533.8]
  • Oracle Database Patch Set Update 12.1.0.1.1 Known Issues (Doc ID 1571651.1)
  • Bug 16902043 – 11.2.0.3.8 (Oct 2013) Database Patch Set Update (PSU) [ID 16902043.8]
  • Oracle Database Patch Set Update 11.2.0.3.8 Known Issues (Doc ID 1571650.1)
  • Patch Set Update and Critical Patch Update October 2013 Availability Document (Doc ID 1571391.1)

The new release, new Bugs here the list of the Multitenant Bugs, which has been fixed:

16427054 - SR12.1.0.2PX_HYBRID_LOAD - TRC - KPDBIDTONAME
16443657 - CDB: OCITRANSCOMMIT() IS ABLE TO COMMIT FROM WRONG CONTAINER
16457621 - W2K8_12.1_CDB: ORA-600 [KKAEGEN_GET_EDITION_NAME_3] TERMINATE INSTANCE
16459685 - CDB (NON RAC) : ORA-44310 AND ORA-07445:[KSPGIP()+106] [SIGSEGV]
16483559 - CDB:COMMON USER NOT SYNCED ON PDB OPEN WITH FORCE OPTION
16485876 - FIRE LOGON TRIGGER DOING DDL IN OTHER CONTAINER GIVES ORA-600 [KTSSCNI1],
16603924 - XSTRM CDB W/ UPG'D PDBS, CREATE_OUTBOUND => ORA-600 [KKAEGEN_GET_EDITION_NAME_1]
16660558 - CDB: ORA-7445 [KSFD_IO] & [KSLWS_DMP_SESS_WAITSTACK] IN CREATE PDB UNDO CALLBACK
16663303 - SR12.1UPD-PLUGIN:DBMS_EDITIONS_UTILITIES FAILS WITH ORA-38817: INSUFFICIENT PRIV
16663465 - SR12.1UPD-PLUGIN -TRC -ORA-600KKDLGETBASEUSER2:AUTHIDTYPE/ORA-04024 SELF-DEADLOC
16675710 - CDB: ORA-7445 [KSUSDIINPROGRESS()+47] [SIGSEGV] [ADDR:0X18] [PC:0XB35190F]
16689109 - INVALID OBJECTS OCCUR WHEN UPGRADING IN A CDB
16697600 - CDB: "ALTER PDB ALL OPEN INSTANCES = ALL" ERRORS IF ALL OPEN ALREADY
16698577 - FA + REDACT: ORA-10387 AND ORA-600 [KGLRELEASEHANDLEREFERENCE1]
16705020 - LNX64-12.1-CDB: HIT ORA-7445 [KSP_PDB_SPFILE_INSERT] WHEN CREATING PDB
16707927 - PKT : ORA-600 [2130] - TRC - KCCUGG
16712618 - CDB:ORPHANED USER CAN BE UNLOCKED
16715647 - CDB-ADG:RESTRICTED OPEN FORCE FOR MULTIPLE PDBS DOES NOT WORK
16730813 - CDB:ORA-65144 WHEN DISABLING RESTRICTED SESSION IN ROOT
16772060 - TT12.1SQLFUZZ2: DBMS_PDB.SYNC_PDB THROWS ORA-600 [KGHSTACK_UNDERFLOW_INTERNAL_1]
16784167 - CDB(NON-RAC):ORA-00600: INTERNAL ERROR CODE, ARGUMENTS: [2801], [], [], [], [],
16784901 - TT12.1SQLFUZZ2: DESC ON RECREATED SUPPLIED OBJ THROWS ORA-7445 [KQLPRFD()+121]
16795944 - TT12.1SQLFUZZ2: PDB OPEN CRASHES AFTER LICENSE_MAX_USERS SET TO LESS THAN CURREN
16825779 - COMMON PROFILE RESOURCE LIMIT FOR PASSWORD VERIFY FUNCTION DISPLAYS FROM ROOT
16836849 - PHSB: CDB ORA-00600:[KTCALLOCXCB] DURING DB OPEN
16859937 - CDB: LOCAL USER CONVERTED TO COMMON
16902138 - RAC: ORA-7445 [RPIDRV] AFTER DROPPING A PDB
16921340 - CDB EXIT: NON-CDB TO PDB PLUGIN HANGS
16935643 - GOT ORA-600 [KQLUDP2] , [0X16EB753A8], [4] WHILE UPGRADING A PDB
16946613 - TT12.1SQLFUZZ2: CMN USER WHICH WAS LOCAL PRIOR TO SYNC NOT SYNCED ON PDB OPEN
16946990 - UNABLE TO INSTALL APEX IN LOCAL PDB 12C DATABASE.RAISES ORA-65050
16993424 - CDB: ORA-600 [KKAEGEN_GET_EDITION_NAME_3], [3]
16994576 - CDB(NON-RAC): ORA-600 [KQLBBOTADD:3]
17000176 - HANG INSIDE CATCDB_INT.SQL CALLED USING CATCON.PL
16911800 - Fix for bug 16911800
16919176 - Fix for bug 16919176

Oracle Database Applicance Release 2.7.0.0.0


On 09. August 2013 Oracle released the 2.7.0.0.0 patch for Oracle Database Appliance.

NOTICE: ODA Note 888888.1 has been updated right now
Description:

  • ODA Bundle Patch
    Contains patches to the following components: OS, Component Firmware and Oracle Appliance Manager Modules, Grid Infrastructure, and RDBMS.
  • End-User GI/RDBMS Clone files
    Contains the latest Grid Infrastructure and RDBMS components, for deployment on an Oracle Database Appliance in the “shipped from factory” state, or an Oracle Database Appliance that has been re-imaged using the OS ISO Image.
  • OS ISO Image
    Used to restore the OS to the “shipped from factory” state. Use only when necessary.
  • Bare Metal
    Refers to the non-virtualized ODA configuration.

Patch ID’s:

  • ORACLE DATABASE APPLIANCE PATCH BUNDLE 2.7.0.0.0 [Patch ID 16662441]
  • ORACLE DATABASE APPLIANCE 2.7.0.0.0 VIRTUALIZED OS ISO IMAGE [Patch ID 16658119]
  • ORACLE DATABASE APPLIANCE 2.7.0.0.0 END-USER BUNDLE (GI/RDBMS Clone) [Patch ID 16662442]
  • ORACLE DATABASE APPLIANCE 2.7.0.0.0 BARE METAL OS ISO IMAGE [Patch ID 16656024]
  • ORACLE DATABASE APPLIANCE 2.7.0.0.0 (GI/RDBMS Clone) TEMPLATE DOWNLOAD FOR VIRTUALIZED PLATFORM [Patch ID 16658314]

Major Changes:

  • For Bare Metal and Virtualized Platform ODA_BASE, Unbreakable Enterprise Kernel upgraded from UEK1 to UEK2 OEL 5.9 (2.7.39-400.111.1.el5uek)
  • For OVM, upgraded from 3.1.1 to 3.2.3 (2.7.39-300.32.1.el5uek)
  • Oracle Database Patch Set Update (PSU) 11.2.0.3.7 and 11.2.0.2.11
  • For hardware (other than X3-2), ILOM / BIOS updated to 3.0.16.22c r80379 / 12010311
  • The oakcli show command has new option to show the hardware version and environment type information:

Version Changes:

Component Name X3-2 Hardware V1 Hardware
Controller 11.05.02.00 11.05.02.00
Expander 000F 342
SSD_SHARED 9432 E12B
HDD_LOCAL A2B0 SF04,SA03
HDD_SHARED A31A 0B25,A700
ILOM 3.1.2.10 r74387 3.0.16.22.c r80379
BIOS 17021300 12010311
IPMI 1.8.10.5 1.8.10.5
HMP 2.2.6.2 2.2.6.2
OAK 2.7.0.0.0 2.7.0.0.0
ORACLE LINUX 5.9 5.9
Kernel 2.6.39-400.111.1.el5uek 2.6.39-400.111.1.el5uek
OVS 3.2.3 3.2.3
Dom0 Kernel 2.6.39-300.32.1.el5uek 2.6.39-300.32.1.el5uek
TFA 2.5.1.5 2.5.1.5
GI_HOME 11.2.0.3.7(16619892,16742216) 11.2.0.3.7(16619892,16742216)
DB_HOME 11.2.0.3.7(16619892,16742216) 11.2.0.3.7(16619892,16742216)
ASR 4.4 4.4

How to update see here

Oracle RAC with OCR mirrored by ASM pitfalls


Since 11gR2 OCR and Voting files can placed into ASM. Here an overview:

ASM Reduncancy Level  OCR Mirrors  Votingdisks  Failgroups  Min. count of disks
EXTERNAL 1 1 1 1
NORMAL 2 3 3 3
HIGH 3 5 5 5

The most common configuration of RAC is a 2 node RAC. For example Oracle database applicance.
If a RAC has one storage the will be no problem and ASM mirror is not nessecary, EXTERNAL redundancy can be used. If the RAC has two storages there is a problem with the Votingdisks. Therefore a third location will be needed. In most configurations two locations are expensive enough and a third location is not available.

Here a real situation:
Customer has two nodes and two storages. All files are mirrored on ASM with normal redundancy, also OCR diskgroup:
Site A: 2x voting, secondary RAC node
Site B: 1x voting, master RAC node

Suddenly site A will break down due to a site desaster. Some seconds later the RAC node on Site B will shutdown due to OCR errors.
Why does this happens:
ASM mirroring is done at block/extent level.

  • EXTERNAL mirroring does mean no mirror
  • NORMAL = extent will be located in one other failgroup
  • HIGH = extent will be located in two other failgroups

Build up on the count of disks needed and the mirror copies witch should be used?

  1. EXTERNAL = not usable for two storages
  2. NORMAL = 3 Disks with 3 voting disks and an OCR mirror
    therefore segmentation of disks is 2:1, but only 2 mirrored blocks of OCR maybe all OCR blocks are on Site A
  3. HIGH = 5 Disks with 5 voting disks and an HIGH OCR mirror
    therefore segmentation of disks is 3:2, but only 3 mirrored blocks of OCR maybe all OCR blocks are on Site A

So what can be done. The solution: NORMAL redundancy with HIGH redundancy OCR mirror. The following construct will be created:
Disk segmentation is 2:1 and 3 mirrored block of OCR. All blocks of the OCR will be mirrored on every Disk. Whatever witch Site on the disaster will happen, at least one OCR mirror copy will be available.

Here the demonstration on 12.1.0.1 GI:
1. Create Cluster with normal redundancy cluster diskgroup DG_CLUSTER
2. Check asm template of OCR asm diskgroup:

SQL> select * from v$asm_template where group_number=1;

GROUP_NUMBER ENTRY_NUMBER REDUND STRIPE S NAME                           PRIM MIRR     CON_ID
------------ ------------ ------ ------ - ------------------------------ ---- ---- ----------
           1          123 MIRROR COARSE Y VOTINGFILE                     COLD COLD          0
           1          343 MIRROR COARSE Y OCRFILE                        COLD COLD          0

3. Check mirror on OCR:

ASMCMD> ls -l +DG_CLUSTER/vmsvr-clu2/OCRFILE
Type     Redund  Striped  Time             Sys  Name
OCRFILE  MIRROR  COARSE   JUL 23 23:00:00  Y    REGISTRY.255.821572803

4. Check ASM extent distribution

SQL>select g.name
2          ,d.path
3          ,e.XNUM_KFFXP extent
4          ,decode(e.lxn_kffxp,0,'primary',1,'mirror-normal','mirror-high') mirrormeta
5  from x$kffxp        e
6        ,v$asm_alias  a
7        ,v$asm_disk   d
8        ,v$asm_diskgroup  g
9  where e.number_kffxp=a.file_number
10       and e.disk_kffxp=d.disk_number
11       and d.group_number = g.group_number
12       and a.name='REGISTRY.255.821572803'
13*      order by 3,4 desc

NAME                         PATH                               EXTENT MIRRORMETA
---------------------------------------------------------------------- -------------
DG_CLUSTER                   ORCL:ORA_DISK_2                         0 primary
DG_CLUSTER                   ORCL:ORA_DISK_1                         0 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_3                         1 primary
DG_CLUSTER                   ORCL:ORA_DISK_1                         1 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_1                         2 primary
DG_CLUSTER                   ORCL:ORA_DISK_3                         2 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_2                         3 primary
DG_CLUSTER                   ORCL:ORA_DISK_3                         3 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_3                         4 primary
DG_CLUSTER                   ORCL:ORA_DISK_2                         4 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_1                         5 primary
DG_CLUSTER                   ORCL:ORA_DISK_2                         5 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_2                         6 primary
DG_CLUSTER                   ORCL:ORA_DISK_1                         6 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_3                         7 primary
DG_CLUSTER                   ORCL:ORA_DISK_1                         7 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_1                         8 primary
DG_CLUSTER                   ORCL:ORA_DISK_3                         8 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_2                         9 primary
DG_CLUSTER                   ORCL:ORA_DISK_3                         9 mirror-normal
DG_CLUSTER                   ORCL:ORA_DISK_3                        10 primary
DG_CLUSTER                   ORCL:ORA_DISK_2                        10 mirror-normal
...

As you can see the diskgroup is made up of 3 disks (ORA_DISK_1 – 3). Further there are only two mirrors of each extent.

5. Backup OCR

[root ~]# ocrconfig -manualbackup
vmsvredu3     2013/07/24 23:51:17     /opt/oracle/12.1/grid/cdata/vmsvr-clu2/backup_20130724_235117.ocr
vmsvredu3     2013/07/23 22:52:10     /opt/oracle/12.1/grid/cdata/vmsvr-clu2/backup_20130723_225210.ocr
vmsvredu3     2013/07/23 22:45:11     /opt/oracle/12.1/grid/cdata/vmsvr-clu2/backup_20130723_224511.ocr

6. To correct this problem if don’t have an OCR mirror, stop cluster and start one node exclusiv and without crsd

crsctl start crs -excl -nocrs

7. Change asm template

SQL> alter diskgroup dg_cluster modify template OCRFILE attributes (HIGH);

Diskgroup altered.

SQL> select * from v$asm_template where group_number=1;

GROUP_NUMBER ENTRY_NUMBER REDUND STRIPE S NAME                           PRIM MIRR     CON_ID
------------ ------------ ------ ------ - ------------------------------ ---- ---- ----------
           1          120 MIRROR COARSE Y PARAMETERFILE                  COLD COLD          0
           1          121 MIRROR COARSE Y ASMPARAMETERFILE               COLD COLD          0
           1          123 MIRROR COARSE Y VOTINGFILE                     COLD COLD          0
           1          124 MIRROR COARSE Y DUMPSET                        COLD COLD          0
           1          125 HIGH   FINE   Y CONTROLFILE                    COLD COLD          0
           1          126 MIRROR COARSE Y FLASHFILE                      COLD COLD          0
           1          127 MIRROR COARSE Y ARCHIVELOG                     COLD COLD          0
           1          128 MIRROR COARSE Y ONLINELOG                      COLD COLD          0
           1          129 MIRROR COARSE Y DATAFILE                       COLD COLD          0
           1          230 MIRROR COARSE Y TEMPFILE                       COLD COLD          0
           1          231 MIRROR COARSE Y BACKUPSET                      COLD COLD          0
           1          232 MIRROR COARSE Y XTRANSPORT BACKUPSET           COLD COLD          0
           1          233 MIRROR COARSE Y INCR XTRANSPORT BACKUPSET      COLD COLD          0
           1          234 MIRROR COARSE Y AUTOBACKUP                     COLD COLD          0
           1          235 MIRROR COARSE Y XTRANSPORT                     COLD COLD          0
           1          237 MIRROR COARSE Y CHANGETRACKING                 COLD COLD          0
           1          238 MIRROR COARSE Y FLASHBACK                      COLD COLD          0
           1          239 MIRROR COARSE Y KEY_STORE                      COLD COLD          0
           1          340 MIRROR COARSE Y AUTOLOGIN_KEY_STORE            COLD COLD          0
           1          341 MIRROR COARSE Y AUDIT_SPILLFILES               COLD COLD          0
           1          342 MIRROR COARSE Y DATAGUARDCONFIG                COLD COLD          0
           1          343 HIGH   COARSE Y OCRFILE                        COLD COLD          0

22 rows selected.

SQL>

8. Remove old OCR

ASMCMD> ls -l
Type     Redund  Striped  Time             Sys  Name
OCRFILE  MIRROR  COARSE   JUL 24 10:00:00  Y    REGISTRY.255.821572803
ASMCMD> rm -f REGISTRY.255.821572803

9. Restore OCR

[root ~]# ocrconfig -restore /opt/oracle/12.1/grid/cdata/vmsvr-clu2/backup_20130724_235117.ocr

10. Check new OCR

ASMCMD> ls -l
Type     Redund  Striped  Time             Sys  Name
OCRFILE  HIGH    COARSE   JUL 24 10:00:00  Y    REGISTRY.255.821615711
ASMCMD>

11. Check crsd starts

[oracle ~]$ crsctl start res ora.crsd -init
CRS-2672: Attempting to start 'ora.crf' on 'vmsvredu3'
CRS-2672: Attempting to start 'ora.storage' on 'vmsvredu3'
CRS-2676: Start of 'ora.storage' on 'vmsvredu3' succeeded
CRS-2676: Start of 'ora.crf' on 'vmsvredu3' succeeded
CRS-2672: Attempting to start 'ora.crsd' on 'vmsvredu3'
CRS-2676: Start of 'ora.crsd' on 'vmsvredu3' succeeded

12. Restart cluster normal

[root ~]# crsctl stop crs -f
CRS-2791: Starting shutdown of Oracle High Availability Services-managed resources on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.crsd' on 'vmsvredu3'
CRS-2677: Stop of 'ora.crsd' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.ctssd' on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.evmd' on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.storage' on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.mdnsd' on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.gpnpd' on 'vmsvredu3'
CRS-2673: Attempting to stop 'ora.drivers.acfs' on 'vmsvredu3'
CRS-2677: Stop of 'ora.storage' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.asm' on 'vmsvredu3'
CRS-2677: Stop of 'ora.drivers.acfs' on 'vmsvredu3' succeeded
CRS-2677: Stop of 'ora.gpnpd' on 'vmsvredu3' succeeded
CRS-2677: Stop of 'ora.mdnsd' on 'vmsvredu3' succeeded
CRS-2677: Stop of 'ora.evmd' on 'vmsvredu3' succeeded
CRS-2677: Stop of 'ora.asm' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.cluster_interconnect.haip' on 'vmsvredu3'
CRS-2677: Stop of 'ora.cluster_interconnect.haip' on 'vmsvredu3' succeeded
CRS-2677: Stop of 'ora.ctssd' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.cssd' on 'vmsvredu3'
CRS-2677: Stop of 'ora.cssd' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.crf' on 'vmsvredu3'
CRS-2677: Stop of 'ora.crf' on 'vmsvredu3' succeeded
CRS-2673: Attempting to stop 'ora.gipcd' on 'vmsvredu3'
CRS-2677: Stop of 'ora.gipcd' on 'vmsvredu3' succeeded
CRS-2793: Shutdown of Oracle High Availability Services-managed resources on 'vmsvredu3' has completed
CRS-4133: Oracle High Availability Services has been stopped.

[root@vmsvredu3 ~]# crsctl start crs
CRS-4123: Oracle High Availability Services has been started.
[root ~]#

13. Check ASM mirroring again:

SQL> select g.name
  2          ,d.path
  3          ,e.XNUM_KFFXP extent
  4          ,decode(e.lxn_kffxp,0,'primary',1,'mirror-normal','mirror-high') mirrormeta
  5  from x$kffxp        e
  6        ,v$asm_alias  a
  7        ,v$asm_disk   d
  8        ,v$asm_diskgroup  g
  9  where e.number_kffxp=a.file_number
 10        and e.disk_kffxp=d.disk_number
 11        and d.group_number = g.group_number
 12        and a.name='REGISTRY.255.821615711'
 13        order by 3,4 desc
 14  ;

NAME                           PATH                               EXTENT MIRRORMETA
------------------------------ ------------------------------ ---------- -------------
DG_CLUSTER                     ORCL:ORA_DISK_1                         0 primary
DG_CLUSTER                     ORCL:ORA_DISK_3                         0 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_2                         0 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_2                         1 primary
DG_CLUSTER                     ORCL:ORA_DISK_3                         1 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_1                         1 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_3                         2 primary
DG_CLUSTER                     ORCL:ORA_DISK_1                         2 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_2                         2 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_1                         3 primary
DG_CLUSTER                     ORCL:ORA_DISK_3                         3 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_2                         3 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_2                         4 primary
DG_CLUSTER                     ORCL:ORA_DISK_3                         4 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_1                         4 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_3                         5 primary
DG_CLUSTER                     ORCL:ORA_DISK_1                         5 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_2                         5 mirror-high
DG_CLUSTER                     ORCL:ORA_DISK_1                         6 primary
DG_CLUSTER                     ORCL:ORA_DISK_3                         6 mirror-normal
DG_CLUSTER                     ORCL:ORA_DISK_2                         6 mirror-high
...

All done. Now a disaster can come.

References: