Vulnerability Details : CVE-2018-14634
Potential exploit
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
Vulnerability category: Overflow
Products affected by CVE-2018-14634
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:a:netapp:active_iq_performance_analytics_services:-:*:*:*:*:*:*:*
Threat overview for CVE-2018-14634
Top countries where our scanners detected CVE-2018-14634
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2018-14634 10,170
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2018-14634!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-14634
3.83%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-14634
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
Red Hat, Inc. |
CWE ids for CVE-2018-14634
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)
References for CVE-2018-14634
-
https://www.exploit-db.com/exploits/45516/
Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) (x64) - 'Mutagen Astronomy' Local Privilege EscalationExploit;Third Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2018:2924
RHSA-2018:2924 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://usn.ubuntu.com/3775-1/
USN-3775-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3590
RHSA-2018:3590 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.paloaltonetworks.com/CVE-2018-14634
CVE-2018-14634 Privilege Escalation in PAN-OS
-
https://usn.ubuntu.com/3779-1/
USN-3779-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2925
RHSA-2018:2925 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634
1624498 – (CVE-2018-14634) CVE-2018-14634 kernel: Integer overflow in Linux's create_elf_tables functionIssue Tracking;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2748
RHSA-2018:2748 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://support.f5.com/csp/article/K20934447?utm_source=f5support&%3Butm_medium=RSS
Linux kernel vulnerability CVE-2018-14634
-
https://security.netapp.com/advisory/ntap-20190204-0002/
CVE-2018-14634 Linux Kernel Integer Overflow Vulnerability in NetApp Products | NetApp Product SecurityPatch;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3586
RHSA-2018:3586 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2021/07/20/2
oss-security - CVE-2021-33910: Denial of service (stack exhaustion) in systemd (PID 1)
-
https://www.openwall.com/lists/oss-security/2018/09/25/4
oss-security - Integer overflow in Linux's create_elf_tables() (CVE-2018-14634)Exploit;Mailing List;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2846
RHSA-2018:2846 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2763
RHSA-2018:2763 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2933
RHSA-2018:2933 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3643
RHSA-2018:3643 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3540
RHSA-2018:3540 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3591
RHSA-2018:3591 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://usn.ubuntu.com/3775-2/
USN-3775-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.securityfocus.com/bid/105407
Linux Kernel 'create_elf_tables()' Function Local Integer Overflow VulnerabilityThird Party Advisory;VDB Entry
Jump to