CVE-2018-14634

HIGH

Description

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

References

http://www.securityfocus.com/bid/105407

https://access.redhat.com/errata/RHSA-2018:2748

https://access.redhat.com/errata/RHSA-2018:2763

https://access.redhat.com/errata/RHSA-2018:2846

https://access.redhat.com/errata/RHSA-2018:2924

https://access.redhat.com/errata/RHSA-2018:2925

https://access.redhat.com/errata/RHSA-2018:2933

https://access.redhat.com/errata/RHSA-2018:3540

https://access.redhat.com/errata/RHSA-2018:3586

https://access.redhat.com/errata/RHSA-2018:3590

https://access.redhat.com/errata/RHSA-2018:3591

https://access.redhat.com/errata/RHSA-2018:3643

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634

https://security.netapp.com/advisory/ntap-20190204-0002/

https://securityadvisories.paloaltonetworks.com/Home/Detail/143

https://usn.ubuntu.com/3775-1/

https://usn.ubuntu.com/3775-2/

https://usn.ubuntu.com/3779-1/

https://www.exploit-db.com/exploits/45516/

https://www.openwall.com/lists/oss-security/2018/09/25/4

Details

Source: MITRE

Published: 2018-09-25

Updated: 2019-03-21

Type: CWE-190

Risk Information

CVSS v2.0

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.9

Severity: HIGH

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH