CVE-2018-14634
Linux Kernel Integer Overflow Vulnerability
Description
CVE-2018-14634 is a high-severity integer overflow vulnerability in the Linux kernel's create_elf_tables() function that enables local privilege escalation. An unprivileged local user with access to a SUID or otherwise privileged binary can exploit this flaw to escalate their privileges to root on affected systems running kernel versions 2.6.x, 3.10.x, and 4.14.x. The vulnerability has a CVSS v3.0 base score of 7.8 (High) with the vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026, and carries an EPSS score of 0.25699 (96.1st percentile), indicating a significantly elevated probability of exploitation. Beyond the Linux kernel itself, the vulnerability also affects downstream products including Palo Alto Networks PAN-OS and multiple F5 BIG-IP modules.
KEV Information
CVSS Score
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 7.1.0, < 7.1.23; >= 8.0.0, < 8.0.16; >= 8.1.0, < 8.1.7 |
| f5 | big-ip access policy manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip advanced firewall manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip analytics | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip application acceleration manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip application security manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip domain name system | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip edge gateway | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip fraud protection service | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip global traffic manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip link controller | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip local traffic manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip policy enforcement manager | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-ip webaccelerator | >= 11.2.1, < 11.6.4; >= 12.1.0, < 12.1.5; >= 13.0.0, < 13.1.1.5; >= 14.0.0, < 14.0.1.1; >= 14.1.0, < 14.1.0.6 |
| f5 | big-iq centralized management | >= 5.0.0, <= 5.4.0; >= 6.0.0, <= 6.0.1; >= 7.0.0, <= 7.1.0; 4.6.0 |
| f5 | big-iq cloud and orchestration | 1.0.0 |
| f5 | enterprise manager | 3.1.1 |
| f5 | iworkflow | >= 2.2.0, <= 2.3.0 |
| f5 | traffix signaling delivery controller | >= 5.0.0, <= 5.1.0; 4.4.0 |
| linux | linux kernel | >= 2.6.0, <= 2.6.39.4; >= 3.10, <= 3.10.102; >= 4.14, <= 4.14.54 |
Multiple CVSS Assessments
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2021/07/20/2(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/105407(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2018:2748(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:2763(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:2846(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:2924(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:2925(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:2933(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:3540(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:3586(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:3590(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:3591(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:3643(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634(Issue Tracking, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20190204-0002/(Patch, Third Party Advisory)
- https://security.paloaltonetworks.com/CVE-2018-14634(Third Party Advisory)
- https://support.f5.com/csp/article/K20934447?utm_source=f5support&%3Butm_medium=RSS(Third Party Advisory)
- https://usn.ubuntu.com/3775-1/(Third Party Advisory)
- https://usn.ubuntu.com/3775-2/(Third Party Advisory)
- https://usn.ubuntu.com/3779-1/(Third Party Advisory)
- https://www.exploit-db.com/exploits/45516/(Exploit, Third Party Advisory, VDB Entry)
- https://www.openwall.com/lists/oss-security/2018/09/25/4(Exploit, Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14634(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
CVE-2018-14634 is classified under CWE-190, which describes software that performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. In the context of this vulnerability, the create_elf_tables() function in the Linux kernel computes the size of argument and environment strings during process execution. When the total size exceeds the maximum representable value for the integer type used, it wraps around to a small number, causing the kernel to allocate an insufficient buffer. This leads to a stack-based buffer overflow condition that an attacker can exploit to overwrite kernel stack data and gain elevated privileges. Learn more about CWE-190
Impact Analysis
Local Privilege Escalation to Root is the primary impact of CVE-2018-14634. An attacker who has obtained any level of local user access on a vulnerable Linux system can exploit this vulnerability to gain full root-level control. This makes the vulnerability particularly dangerous in shared hosting environments, container-based deployments, and any scenario where untrusted users have shell access.
Confidentiality Impact is rated as high (C:H). Once root access is achieved, the attacker can read any file on the system, including shadow password files, cryptographic keys, database credentials, application secrets, and all user data. In enterprise environments, this may enable access to sensitive business data, customer records, and security infrastructure configurations.
Integrity Impact is rated as high (I:H). With root privileges, the attacker can modify any system file, install rootkits or backdoors, alter audit logs to conceal their activity, tamper with application binaries, and modify kernel modules. The ability to alter system integrity at the deepest level makes post-exploitation detection and remediation extremely challenging.
Availability Impact is rated as high (A:H). Root access allows the attacker to shut down services, destroy data, exhaust system resources, or render the system completely inoperable. In production environments, this could result in significant downtime and service disruption affecting all users and applications hosted on the compromised system.
Broad Attack Surface extends beyond standalone Linux servers. The vulnerability affects Palo Alto Networks PAN-OS (versions 7.1.x through 8.1.x) and numerous F5 BIG-IP product modules (versions 11.2.1 through 14.1.x), meaning that network security appliances and application delivery controllers are also at risk. The EPSS score of 0.25699 (96.1st percentile) reflects substantial real-world exploitation interest. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2018-14634 has been confirmed as actively exploited, which is reflected in its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026. The EPSS score of 0.25699 places this vulnerability in the 96.1st percentile, meaning it has a higher probability of exploitation than approximately 96% of all known vulnerabilities.
Public Disclosure and Exploit Development: The vulnerability was publicly disclosed in September 2018 and received significant attention from the security research community. Detailed technical analyses were published through the oss-security mailing list at Openwall, providing sufficient technical detail for exploit development. The integer overflow in create_elf_tables() is conceptually straightforward to exploit on systems with SUID binaries, which are present on virtually all Linux installations.
Exploitation Prerequisites: The attack requires only low-privilege local access (PR:L) with no user interaction needed (UI:N). This low barrier to exploitation means that any foothold on a vulnerable system, whether through a compromised web application, SSH access, or container escape, can be leveraged into full root access.
Ransomware Association: CISA lists the ransomware association for this vulnerability as "Unknown," meaning there is no confirmed public reporting of ransomware campaigns specifically leveraging CVE-2018-14634. However, the privilege escalation capability makes it a natural component in multi-stage attack chains that could culminate in ransomware deployment.
Remediation
-
Apply kernel patches from your Linux distribution. Red Hat released multiple security advisories addressing this vulnerability, including RHSA-2018:2748, RHSA-2018:2763, RHSA-2018:2846, RHSA-2018:2924, RHSA-2018:2925, and RHSA-2018:2933. Apply the appropriate patch for your distribution version and reboot the system to load the updated kernel.
-
Update Palo Alto Networks PAN-OS to a fixed version if running affected versions. Upgrade PAN-OS 7.1.x to at least 7.1.23, PAN-OS 8.0.x to at least 8.0.16, and PAN-OS 8.1.x to at least 8.1.7. These versions include the patched Linux kernel that eliminates the integer overflow in create_elf_tables().
-
Update F5 BIG-IP modules across all affected product lines. Upgrade BIG-IP 11.x to at least 11.6.4, BIG-IP 12.x to at least 12.1.5, BIG-IP 13.x to at least 13.1.1.5, BIG-IP 14.0.x to at least 14.0.1.1, and BIG-IP 14.1.x to at least 14.1.0.6. This applies to all affected BIG-IP modules including APM, AFM, Analytics, AAM, ASM, DNS, and Edge Gateway.
-
Restrict SUID binary access as a temporary mitigation if immediate patching is not possible. Audit SUID binaries on the system using
find / -perm -4000and remove the SUID bit from any binary that is not strictly required. This reduces the attack surface by limiting the privileged binaries available for exploitation. -
Implement kernel hardening measures such as enabling ASLR, restricting ptrace, and limiting core dump creation. Set
kernel.randomize_va_space=2in sysctl, configurekernel.yama.ptrace_scope=1, and ensure that unprivileged users cannot access kernel symbols through/proc/kallsyms. These measures increase the difficulty of reliable exploitation even on unpatched systems.
Technical Details
CVE-2018-14634 is an integer overflow in the Linux kernel's create_elf_tables() function, which is invoked during the execution of ELF binaries. The function is responsible for setting up the initial stack frame for a new process, including copying argument strings (argv) and environment strings (envp) onto the user stack.
Overflow Mechanism: The vulnerability occurs when the create_elf_tables() function calculates the total size of argument and environment string data. The function uses an unsigned long variable to accumulate the total byte count, but a subsequent calculation that determines the number of memory pages required for these strings can overflow an integer boundary. When a user provides an extremely large number of arguments or environment variables to an execve() system call targeting a SUID binary, the accumulated size exceeds the integer limit and wraps around to a small value. This causes the kernel to allocate an inadequately sized stack region.
CVSS Vector Breakdown: The vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable vulnerability (AV:L) with low attack complexity (AC:L) requiring only low-privilege access (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U), meaning the vulnerable component and impacted component are the same (the Linux kernel). All three impact metrics are high (C:H/I:H/A:H) because successful exploitation yields root-level access.
Exploitation Approach: The attacker crafts an execve() call to a SUID binary with a carefully calculated total argument size that triggers the integer overflow. When the kernel allocates an undersized stack and copies the oversized argument data, the overflow corrupts adjacent kernel stack data structures. By controlling the overflow content, the attacker can overwrite kernel function pointers or return addresses to redirect execution to attacker-controlled code, ultimately gaining root privileges.
Affected Kernel Versions: The vulnerability affects Linux kernel versions 2.6.x, 3.10.x (used in RHEL/CentOS 7), and 4.14.x (used in various distributions). The create_elf_tables() function has existed in the kernel for many years, but the exploitability depends on specific kernel configurations and the available SUID binaries on the target system.
Frequently Asked Questions
What is CVE-2018-14634?
CVE-2018-14634 is an integer overflow vulnerability in the Linux kernel's create_elf_tables() function that allows an unprivileged local user to escalate their privileges to root. It was discovered in September 2018 and affects kernel versions 2.6.x, 3.10.x, and 4.14.x, as well as downstream products like Palo Alto Networks PAN-OS and F5 BIG-IP.
How can an attacker exploit CVE-2018-14634?
An attacker with local access to a vulnerable system needs to execute a SUID binary with a specially crafted set of arguments that causes an integer overflow in the kernel's stack size calculation. The resulting undersized stack allocation leads to a buffer overflow that the attacker can leverage to overwrite kernel data and gain root privileges. No user interaction is required beyond the attacker having a local shell.
Which products are affected beyond the Linux kernel?
Beyond the Linux kernel itself, the vulnerability affects Palo Alto Networks PAN-OS versions 7.1.0 through 8.1.6, and numerous F5 BIG-IP modules across versions 11.2.1 through 14.1.0.5. These products run embedded Linux systems that include the vulnerable kernel code. Administrators of these appliances should apply vendor-specific firmware updates in addition to patching standalone Linux servers.
Is CVE-2018-14634 used in ransomware attacks?
CISA lists the ransomware association for CVE-2018-14634 as "Unknown." While there is no confirmed public reporting of ransomware campaigns specifically using this vulnerability, the privilege escalation capability it provides is a common component in multi-stage attacks that could culminate in ransomware deployment. The vulnerability's EPSS score of 0.25699 (96.1st percentile) indicates significant ongoing exploitation interest.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.