CVE-2018-14634

Published Sep 25, 2018

Last updated 13 days ago

Overview

Description
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
Source
secalert@redhat.com
NVD status
Analyzed
Products
pan-os, big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_fraud_protection_service, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_webaccelerator, big-iq_centralized_management, big-iq_cloud_and_orchestration, enterprise_manager, iworkflow, traffix_signaling_delivery_controller, linux_kernel, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_server_tus, enterprise_linux_workstation, ubuntu_linux, snapprotect

Risk scores

CVSS 3.0

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
7.2
Impact score
10
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:C/I:C/A:C

Known exploits

Data from CISA

Vulnerability name
Linux Kernel Integer Overflow Vulnerability
Exploit added on
Jan 26, 2026
Exploit action due
Feb 16, 2026
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secalert@redhat.com
CWE-190
nvd@nist.gov
CWE-190

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.