CVE-2018-14634: Linux Kernel Integer Overflow, actively exploited

Description

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

Affected products

F5 Big-ip Access Policy Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Advanced Firewall Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Analytics≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Application Acceleration Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Application Security Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Domain Name System≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Edge Gateway≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Fraud Protection Service≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Global Traffic Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Link Controller≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Local Traffic Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Policy Enforcement Manager≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-ip Webaccelerator≥ 11.2.1 < 11.6.4 · ≥ 12.1.0 < 12.1.5 · ≥ 13.0.0 < 13.1.1.5 · ≥ 14.0.0 < 14.0.1.1

F5 Big-iq Centralized Management≥ 5.0.0 ≤ 5.4.0 · ≥ 6.0.0 ≤ 6.0.1 · ≥ 7.0.0 ≤ 7.1.0 · 4.6.0

F5 Big-iq Cloud And Orchestration1.0.0

F5 Enterprise Manager3.1.1

F5 Iworkflow≥ 2.2.0 ≤ 2.3.0

F5 Traffix Signaling Delivery Controller≥ 5.0.0 ≤ 5.1.0 · 4.4.0

Netapp Snapprotectall versions

Canonical Ubuntu Linux12.04 · 14.04

Linux Kernel≥ 2.6.0 ≤ 2.6.39.4 · ≥ 3.10 ≤ 3.10.102 · ≥ 4.14 ≤ 4.14.54

Palo Alto Networks PAN-OS≥ 7.1.0 < 7.1.23 · ≥ 8.0.0 < 8.0.16 · ≥ 8.1.0 < 8.1.7

Redhat Enterprise Linux Desktop6.0 · 7.0

Redhat Enterprise Linux Server6.0 · 7.0

Remediation

Fixed in

F5 Big-ip Access Policy Manager≥ 11.6.4

F5 Big-ip Advanced Firewall Manager≥ 11.6.4

F5 Big-ip Analytics≥ 11.6.4

F5 Big-ip Application Acceleration Manager≥ 11.6.4

F5 Big-ip Application Security Manager≥ 11.6.4

F5 Big-ip Domain Name System≥ 11.6.4

F5 Big-ip Edge Gateway≥ 11.6.4

F5 Big-ip Fraud Protection Service≥ 11.6.4

F5 Big-ip Global Traffic Manager≥ 11.6.4

F5 Big-ip Link Controller≥ 11.6.4

Patch & vendor advisories

https://security.netapp.com/advisory/ntap-20190204-0002/

References

https://access.redhat.com/errata/RHSA-2018:2748Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2763Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2846Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2924Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2925Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2933Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3540Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3586Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3590Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3591Third Party Advisory

and 13 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2018-14634 being actively exploited?

Yes. CVE-2018-14634 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 Jan 2026.

Which products are affected by CVE-2018-14634?

Affected products include F5 Big-ip Access Policy Manager, F5 Big-ip Advanced Firewall Manager, F5 Big-ip Analytics, F5 Big-ip Application Acceleration Manager, F5 Big-ip Application Security Manager, and 19 more.

How do I fix CVE-2018-14634?

Upgrade affected software to a fixed version, for example F5 Big-ip Access Policy Manager 11.6.4, F5 Big-ip Advanced Firewall Manager 11.6.4, F5 Big-ip Analytics 11.6.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-14634 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo