cbcvebase.
CVE-2018-14634
published 2018-09-25

CVE-2018-14634: An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged)…

PriorityP183high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-02-16
Exploited in the wild
EPSS
14.81%
96.3th percentile
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

Affected

104 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
debianlinux< linux 4.12.6-1 (bookworm)linux 4.12.6-1 (bookworm)
f5big-ip_access_policy_manager>= 11.2.1 < 11.6.411.6.4
f5big-ip_access_policy_manager>= 12.1.0 < 12.1.512.1.5
f5big-ip_access_policy_manager>= 13.0.0 < 13.1.1.513.1.1.5
f5big-ip_access_policy_manager>= 14.0.0 < 14.0.1.114.0.1.1
f5big-ip_access_policy_manager>= 14.1.0 < 14.1.0.614.1.0.6
f5big-ip_advanced_firewall_manager>= 11.2.1 < 11.6.411.6.4
f5big-ip_advanced_firewall_manager>= 12.1.0 < 12.1.512.1.5
f5big-ip_advanced_firewall_manager>= 13.0.0 < 13.1.1.513.1.1.5
f5big-ip_advanced_firewall_manager>= 14.0.0 < 14.0.1.114.0.1.1
f5big-ip_advanced_firewall_manager>= 14.1.0 < 14.1.0.614.1.0.6
f5big-ip_analytics>= 11.2.1 < 11.6.411.6.4
f5big-ip_analytics>= 12.1.0 < 12.1.512.1.5
f5big-ip_analytics>= 13.0.0 < 13.1.1.513.1.1.5
f5big-ip_analytics>= 14.0.0 < 14.0.1.114.0.1.1
f5big-ip_analytics>= 14.1.0 < 14.1.0.614.1.0.6
f5big-ip_application_acceleration_manager>= 11.2.1 < 11.6.411.6.4
f5big-ip_application_acceleration_manager>= 12.1.0 < 12.1.512.1.5
f5big-ip_application_acceleration_manager>= 13.0.0 < 13.1.1.513.1.1.5
f5big-ip_application_acceleration_manager>= 14.0.0 < 14.0.1.114.0.1.1
f5big-ip_application_acceleration_manager>= 14.1.0 < 14.1.0.614.1.0.6
f5big-ip_application_security_manager>= 11.2.1 < 11.6.411.6.4
f5big-ip_application_security_manager>= 12.1.0 < 12.1.512.1.5

Detection & IOCsextracted from sources · hover to see the quote

processcreate_elf_tables()
  • The exploit targets 64-bit systems only; privilege escalation via a SUID-root binary exploiting an integer overflow in create_elf_tables(). Monitor for unprivileged users executing SUID binaries with abnormally large argument/environment vectors.
  • Exploitation requires the system to have at least 32GB of RAM; systems below this threshold are unlikely to be successfully exploited due to memory demands during exploitation.
  • The vulnerability is triggered during ELF binary loading; monitor for processes attempting to map extremely large argument/environment arrays (approaching MAX_ARG_STRINGS or MAX_ARG_STRLEN limits) when executing SUID binaries.
  • Vulnerable kernel versions are 2.6.x, 3.10.x, and 4.14.x; patch status should be verified against these branches. The flaw is known as 'Mutagen Astronomy'.
  • ·Exploitation is only feasible on 64-bit systems; 32-bit systems are not affected by this integer overflow in create_elf_tables().
  • ·Systems with less than 32GB of RAM are practically protected from exploitation due to the memory requirements of the attack.

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.