{"id":"CVE-2018-14634","kind":"vulnerability","aliases":["CVE-2018-14634"],"related":[],"title":"An integer overflow flaw was found in the Linux kernel's create_elf_tables() function","description":"Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"The Linux kernel has an integer overflow in create_elf_tables() that lets a local user abuse a SUID or otherwise privileged binary to gain root. CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-01-26T00:00:00+00:00","products":[{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["7.1.23"],"affected":">= 7.1.0, < 7.1.23","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["8.0.16"],"affected":">= 8.0.0, < 8.0.16","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["8.1.7"],"affected":">= 8.1.0, < 8.1.7","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":["13.1.1.5"],"affected":">= 13.0.0, < 13.1.1.5","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":["14.0.1.1"],"affected":">= 14.0.0, < 14.0.1.1","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":["14.1.0.6"],"affected":">= 14.1.0, < 14.1.0.6","ecosystem":"vendor"},{"name":"f5 big-ip fraud protection service","fixed":["11.6.4"],"affected":">= 11.2.1, < 11.6.4","ecosystem":"vendor"},{"name":"f5 big-ip fraud protection service","fixed":["12.1.5"],"affected":">= 12.1.0, < 12.1.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["single-user-machine-with-no-untrusted-local-users"],"how_to_check":null,"fix":"Apply the kernel vendor's patched kernel for your distribution; CISA says to apply mitigations per vendor instructions, and the sources do not name a fixed version.","status":"open","published_at":"2018-09-25T21:29:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:32+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:42:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the kernel vendor's patched kernel for your distribution; CISA says to apply mitigations per vendor instructions, and the sources do not name a fixed version.","reach":"local","summary":"The Linux kernel has an integer overflow in create_elf_tables() that lets a local user abuse a SUID or otherwise privileged binary to gain root. CISA lists it as actively exploited.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"local unprivileged user gains root on the host through a privileged binary","analyst_note":"Find the affected kernel version range and patched versions from the upstream kernel commit or distro advisories for CVE-2018-14634, since the sources give no fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-user-machine-with-no-untrusted-local-users"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000435,"input_tokens":2546,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':366C '-14634':18A,21A '-2018':17A,20A '22':365C 'abus':303B 'acceleration':136A,143A,150A,157A,164A 'access':40A,47A,54A,61A,68A,340C 'action':356C 'activ':317B 'advanced':75A,82A,89A,96A,103A 'allow':334C 'analytics':110A,115A,120A,125A,130A 'appli':357C 'applic':363C 'application':135A,142A,149A,156A,163A,170A,177A,184A,191A,198A 'big':38A,45A,52A,59A,66A,73A,80A,87A,94A,101A,108A,113A,118A,123A,128A,133A,140A,147A,154A,161A,168A,175A,182A,189A,196A,203A,210A,217A,224A,231A,238A,244A,250A,256A,262A,268A,275A 'big-ip':37A,44A,51A,58A,65A,72A,79A,86A,93A,100A,107A,112A,117A,122A,127A,132A,139A,146A,153A,160A,167A,174A,181A,188A,195A,202A,209A,216A,223A,230A,237A,243A,249A,255A,261A,267A,274A 'binari':309B,346C 'bod':364C 'cisa':313B,354C 'cloud':369C 'contain':321C 'could':333C 'creat':12A,295B,328C 'cve':16A,19A 'discontinu':372C 'domain':205A,212A,219A,226A,233A 'edge':240A,246A,252A,258A,264A 'elf':13A,296B,329C 'escal':348C 'exploit':280B,318B 'f5':36A,43A,50A,57A,64A,71A,78A,85A,92A,99A,106A,111A,116A,121A,126A,131A,138A,145A,152A,159A,166A,173A,180A,187A,194A,201A,208A,215A,222A,229A,236A,242A,248A,254A,260A,266A,273A 'firewall':76A,83A,90A,97A,104A 'flaw':4A 'follow':362C 'found':6A 'fraud':270A,277A 'function':15A,331C 'gain':311B 'gateway':241A,247A,253A,259A,265A 'guidanc':367C 'host':286B 'infrastructur':281B 'instruct':361C 'integ':2A,292B,323C 'ip':39A,46A,53A,60A,67A,74A,81A,88A,95A,102A,109A,114A,119A,124A,129A,134A,141A,148A,155A,162A,169A,176A,183A,190A,197A,204A,211A,218A,225A,232A,239A,245A,251A,257A,263A,269A,276A 'kernel':10A,23A,289B,320C 'kubernet':282B 'let':299B 'linux':9A,22A,283B,288B,319C 'list':314B 'local':301B,337C 'manager':42A,49A,56A,63A,70A,77A,84A,91A,98A,105A,137A,144A,151A,158A,165A,172A,179A,186A,193A,200A 'mitig':358C,378C 'name':206A,213A,220A,227A,234A 'os':27A,31A,35A 'otherwis':307B,344C 'overflow':3A,293B,324C 'paloaltonetworks':24A,28A,32A 'pan':26A,30A,34A 'pan-os':25A,29A,33A 'per':359C 'policy':41A,48A,55A,62A,69A 'privileg':308B,345C,350C 'product':376C 'protection':271A,278A 'requir':355C 'root':312B 'security':171A,178A,185A,192A,199A 'self':285B 'self-host':284B 'servic':370C 'service':272A,279A 'suid':305B,342C 'system':207A,214A,221A,228A,235A,353C 'tabl':14A,297B,330C 'unavail':380C 'unprivileg':336C 'use':373C 'user':302B,338C 'vendor':360C 'vulner':325C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-09-25T21:29:00+00:00","kev":{"dateAdded":"2026-01-26","dueDate":"2026-02-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-14634","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14634","severity":null,"published_at":"2026-01-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-14634","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14634","severity":null,"published_at":"2018-09-25T21:29:00+00:00","modified_at":"2026-06-17T01:41:20+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}