In CISA KEV7.8 HighCWE-190
CVE-2018-14634
Linux Kernel Integer Overflow Vulnerability
LinuxKernel
Status
- Exploited in the wild
- In CISA KEV since 26 Jan
- Vendor fix available
Federal deadlineMon 16 Feb, 23:59 UTC
Passed 250 days ago
CISA KEV · added 26 Jan
Exploit probabilityEPSSchecked 25 Oct
15%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
SeverityCVSS
7.8High
Description NVD
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 27 Jan · 10:50 UTC | SecurityWeek | Organizations Warned of Exploited Linux Vulnerabilities |
| Tue 27 Jan · 15:40 UTC | Security Affairs | U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog |
- U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- Organizations Warned of Exploited Linux VulnerabilitiesSecurityWeek · first in our coverage · mentions it in passing