Two recent security exposures were discovered in RancherOS versions 1.0.2 and prior. The kernel exploit allows for local memory to be corrupted, which enables an escalation of privileges. The second exploit affects applications compiled with the GNU glibc library. This too allows local memory corruption that enables the attacker to exploit this issue and execute arbitrary code in the context of the application.
What is affected:
Linux Kernel CVE-2017-1000364 Local Memory Corruption Vulnerability
Attackers may be able to exploit this issue to execute arbitrary code with elevated privileges. Failed attack attempts will likely result in denial-of-service conditions.
Linux Kernel 4.11.5 and prior versions are vulnerable.
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
An attacker could exploit this issue to execute arbitrary code in the context of the application.
GNU glibc 2.25 and prior versions are vulnerable.