Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14634

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

Published

2018-09-25T21:29:00.390

Last Modified

2026-01-27T15:55:15.890

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.0: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Secondary
CWE-190
Type: Secondary
CWE-190

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	paloaltonetworks	pan-os	< 7.1.23	Yes
Operating System	paloaltonetworks	pan-os	< 8.0.16	Yes
Operating System	paloaltonetworks	pan-os	< 8.1.7	Yes
Application	f5	big-ip_access_policy_manager	< 11.6.4	Yes
Application	f5	big-ip_access_policy_manager	< 12.1.5	Yes
Application	f5	big-ip_access_policy_manager	< 13.1.1.5	Yes
Application	f5	big-ip_access_policy_manager	< 14.0.1.1	Yes
Application	f5	big-ip_access_policy_manager	< 14.1.0.6	Yes
Application	f5	big-ip_advanced_firewall_manager	< 11.6.4	Yes
Application	f5	big-ip_advanced_firewall_manager	< 12.1.5	Yes
Application	f5	big-ip_advanced_firewall_manager	< 13.1.1.5	Yes
Application	f5	big-ip_advanced_firewall_manager	< 14.0.1.1	Yes
Application	f5	big-ip_advanced_firewall_manager	< 14.1.0.6	Yes
Application	f5	big-ip_analytics	< 11.6.4	Yes
Application	f5	big-ip_analytics	< 12.1.5	Yes
Application	f5	big-ip_analytics	< 13.1.1.5	Yes
Application	f5	big-ip_analytics	< 14.0.1.1	Yes
Application	f5	big-ip_analytics	< 14.1.0.6	Yes
Application	f5	big-ip_application_acceleration_manager	< 11.6.4	Yes
Application	f5	big-ip_application_acceleration_manager	< 12.1.5	Yes
Application	f5	big-ip_application_acceleration_manager	< 13.1.1.5	Yes
Application	f5	big-ip_application_acceleration_manager	< 14.0.1.1	Yes
Application	f5	big-ip_application_acceleration_manager	< 14.1.0.6	Yes
Application	f5	big-ip_application_security_manager	< 11.6.4	Yes
Application	f5	big-ip_application_security_manager	< 12.1.5	Yes
Application	f5	big-ip_application_security_manager	< 13.1.1.5	Yes
Application	f5	big-ip_application_security_manager	< 14.0.1.1	Yes
Application	f5	big-ip_application_security_manager	< 14.1.0.6	Yes
Application	f5	big-ip_domain_name_system	< 11.6.4	Yes
Application	f5	big-ip_domain_name_system	< 12.1.5	Yes
Application	f5	big-ip_domain_name_system	< 13.1.1.5	Yes
Application	f5	big-ip_domain_name_system	< 14.0.1.1	Yes
Application	f5	big-ip_domain_name_system	< 14.1.0.6	Yes
Application	f5	big-ip_edge_gateway	< 11.6.4	Yes
Application	f5	big-ip_edge_gateway	< 12.1.5	Yes
Application	f5	big-ip_edge_gateway	< 13.1.1.5	Yes
Application	f5	big-ip_edge_gateway	< 14.0.1.1	Yes
Application	f5	big-ip_edge_gateway	< 14.1.0.6	Yes
Application	f5	big-ip_fraud_protection_service	< 11.6.4	Yes
Application	f5	big-ip_fraud_protection_service	< 12.1.5	Yes
Application	f5	big-ip_fraud_protection_service	< 13.1.1.5	Yes
Application	f5	big-ip_fraud_protection_service	< 14.0.1.1	Yes
Application	f5	big-ip_fraud_protection_service	< 14.1.0.6	Yes
Application	f5	big-ip_global_traffic_manager	< 11.6.4	Yes
Application	f5	big-ip_global_traffic_manager	< 12.1.5	Yes
Application	f5	big-ip_global_traffic_manager	< 13.1.1.5	Yes
Application	f5	big-ip_global_traffic_manager	< 14.0.1.1	Yes
Application	f5	big-ip_global_traffic_manager	< 14.1.0.6	Yes
Application	f5	big-ip_link_controller	< 11.6.4	Yes
Application	f5	big-ip_link_controller	< 12.1.5	Yes
Application	f5	big-ip_link_controller	< 13.1.1.5	Yes
Application	f5	big-ip_link_controller	< 14.0.1.1	Yes
Application	f5	big-ip_link_controller	< 14.1.0.6	Yes
Application	f5	big-ip_local_traffic_manager	< 11.6.4	Yes
Application	f5	big-ip_local_traffic_manager	< 12.1.5	Yes
Application	f5	big-ip_local_traffic_manager	< 13.1.1.5	Yes
Application	f5	big-ip_local_traffic_manager	< 14.0.1.1	Yes
Application	f5	big-ip_local_traffic_manager	< 14.1.0.6	Yes
Application	f5	big-ip_policy_enforcement_manager	< 11.6.4	Yes
Application	f5	big-ip_policy_enforcement_manager	< 12.1.5	Yes
Application	f5	big-ip_policy_enforcement_manager	< 13.1.1.5	Yes
Application	f5	big-ip_policy_enforcement_manager	< 14.0.1.1	Yes
Application	f5	big-ip_policy_enforcement_manager	< 14.1.0.6	Yes
Application	f5	big-ip_webaccelerator	< 11.6.4	Yes
Application	f5	big-ip_webaccelerator	< 12.1.5	Yes
Application	f5	big-ip_webaccelerator	< 13.1.1.5	Yes
Application	f5	big-ip_webaccelerator	< 14.0.1.1	Yes
Application	f5	big-ip_webaccelerator	< 14.1.0.6	Yes
Application	f5	big-iq_centralized_management	≤ 5.4.0	Yes
Application	f5	big-iq_centralized_management	≤ 6.0.1	Yes
Application	f5	big-iq_centralized_management	≤ 7.1.0	Yes
Application	f5	big-iq_centralized_management	4.6.0	Yes
Application	f5	big-iq_cloud_and_orchestration	1.0.0	Yes
Application	f5	enterprise_manager	3.1.1	Yes
Application	f5	iworkflow	≤ 2.3.0	Yes
Application	f5	traffix_signaling_delivery_controller	≤ 5.1.0	Yes
Application	f5	traffix_signaling_delivery_controller	4.4.0	Yes
Operating System	linux	linux_kernel	≤ 2.6.39.4	Yes
Operating System	linux	linux_kernel	≤ 3.10.102	Yes
Operating System	linux	linux_kernel	≤ 4.14.54	Yes
Operating System	redhat	enterprise_linux_desktop	6.0	Yes
Operating System	redhat	enterprise_linux_desktop	7.0	Yes
Operating System	redhat	enterprise_linux_server	6.0	Yes
Operating System	redhat	enterprise_linux_server	7.0	Yes
Operating System	redhat	enterprise_linux_server_aus	6.5	Yes
Operating System	redhat	enterprise_linux_server_aus	6.6	Yes
Operating System	redhat	enterprise_linux_server_aus	7.6	Yes
Operating System	redhat	enterprise_linux_server_eus	6.7	Yes
Operating System	redhat	enterprise_linux_server_eus	7.5	Yes
Operating System	redhat	enterprise_linux_server_eus	7.6	Yes
Operating System	redhat	enterprise_linux_server_tus	6.6	Yes
Operating System	redhat	enterprise_linux_server_tus	7.6	Yes
Operating System	redhat	enterprise_linux_workstation	6.0	Yes
Operating System	redhat	enterprise_linux_workstation	7.0	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Application	netapp	snapprotect	-	Yes

References

http://www.openwall.com/lists/oss-security/2021/07/20/2 Mailing List, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/105407 Third Party Advisory, VDB Entry, Broken Link ([email protected])
https://access.redhat.com/errata/RHSA-2018:2748 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2763 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2846 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2924 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2925 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2933 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:3540 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:3586 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:3590 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:3591 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:3643 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634 Issue Tracking, Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20190204-0002/ Patch, Third Party Advisory ([email protected])
https://security.paloaltonetworks.com/CVE-2018-14634 Third Party Advisory ([email protected])
https://support.f5.com/csp/article/K20934447?utm_source=f5support&amp%3Butm_medium=RSS Third Party Advisory ([email protected])
https://usn.ubuntu.com/3775-1/ Third Party Advisory ([email protected])
https://usn.ubuntu.com/3775-2/ Third Party Advisory ([email protected])
https://usn.ubuntu.com/3779-1/ Third Party Advisory ([email protected])
https://www.exploit-db.com/exploits/45516/ Exploit, Third Party Advisory, VDB Entry ([email protected])
https://www.openwall.com/lists/oss-security/2018/09/25/4 Exploit, Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/07/20/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/105407 Third Party Advisory, VDB Entry, Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2748 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2763 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2846 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2924 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2925 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2933 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:3540 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:3586 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:3590 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:3591 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:3643 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20190204-0002/ Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.paloaltonetworks.com/CVE-2018-14634 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.f5.com/csp/article/K20934447?utm_source=f5support&amp%3Butm_medium=RSS Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3775-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3775-2/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3779-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/45516/ Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2018/09/25/4 Exploit, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14634 US Government Resource (134c704f-9b21-4f2e-91b3-4a467353bcc0)