Oracle has released glibc and openssl updates for Ksplice:

New glibc updates available via Ksplice (ELSA-2018-3092)
New openssl updates available via Ksplice (ELSA-2018-3221)

New glibc updates available via Ksplice (ELSA-2018-3092)

Synopsis: ELSA-2018-3092 can now be patched using Ksplice
CVEs: CVE-2018-11236 CVE-2018-11237 CVE-2018-6485

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-3092.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 7 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
glibc RPMs and statically linked applications using
glibc should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages. Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details. Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2018-6485: Code execution in posix_memalign().

An integer overflow in the glibc memalign functions could result in
returning an undersized buffer. This could result in heap overflows and
potentially, code execution.


* CVE-2018-11236: Code execution in realpath().

An integer overflow in the realpath() function could result in a stack
overflow and code execution. A user with the ability to pass in
maliciously formed paths to a vulnerable application could use this flaw
to gain code execution in the process.


* CVE-2018-11237: Code execution in AVX512 memcpy().

A buffer overflow in the AVX512 version of memcpy() could result in
memory corruption and potentially allowing an attacker to gain code
execution in a vulnerable application.


Note: Ksplice will not be providing a zero-downtime update for
CVE-2017-16997. Applications requiring patching for CVE-2017-16997
should restart with a new glibc.

SUPPORT

Ksplice support is available at ksplice-support_ww@oracle.com.

New openssl updates available via Ksplice (ELSA-2018-3221)

Synopsis: ELSA-2018-3221 can now be patched using Ksplice
CVEs: CVE-2017-3735 CVE-2018-0495 CVE-2018-0739

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-3221.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 7 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
openssl RPMs and statically linked applications using
openssl should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages. Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details. Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2018-0739: Denial-of-service in ASN.1 recursive definitions.

Constructed ASN.1 types with a recursive definition could result in a
stack overflow. A malicious remote user could use this flaw against a
vulnerable application to trigger a crash and denial of service.


* CVE-2018-0495: Information leak in ECDSA signature side-channel.

A cache side-channel in ECDSA signatures could allow a local user to
leak key material.


* CVE-2017-3735: Information leak in X.509 certificate display.

An X.509 certificate with a malformed IPAddressFamily extension could
display an extra byte, leaking memory contents or causing a consumer to
misbehave.


Note: Ksplice will not be providing a zero-downtime update for
CVE-2018-0495 on OpenSSL 1.0.1e-60.0.1.ksplice1.el7_3.1 and older.
Applications requiring protection for CVE-2018-0495 should restart with
a newer version of OpenSSL.

SUPPORT

Ksplice support is available at ksplice-support_ww@oracle.com.