CVE-2018-14634 HIGH

CVE-2018-14634

Vendor The Linux Foundation
Product kernel
Weakness CWE-190
KEV Status Known Exploited
Published September 25, 2018
Last update January 27, 2026
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

September 25, 2018 CVE published
January 27, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-14634 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/190.html CISA KEV Reference https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.g… CISA KEV Reference https://www.kernel.org/ CISA KEV Reference https://www.cve.org/CVERecord?id=CVE-2018-14634 CISA KEV Reference https://access.redhat.com/errata/RHSA-2018:3540 CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2018-14634