CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability
A flaw was found in the Linux kernels with commit b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) but without commit da029c11e6b1 ("exec:Limit arg stack to at most 75% of STKLIM", from July 7, 2017). An integer overflow in the Linux kernel's createelftables() function. A local attacker can exploit this vulnerability via a SUID-root binary and obtain full root privileges.
Referenced commits: b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) https://github.com/torvalds/linux/commit/b6a2fea39318e43fee84fa7b0b90d68bed92d2ba
da029c11e6b1 ("exec: Limit arg stack to at most 75% of STKLIM", from July 7, 2017) https://github.com/torvalds/linux/commit/da029c11e6b12f321f36dac8771e833b65cec962
Additional references: https://www.qualys.com/2018/09/25/cve-2018-14634/mutagen-astronomy-integer-overflow-linux-createelftables-cve-2018-14634.txt
Other sources
An integer overflow flaw was found in the Linux kernel's createelftables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system.
Linux Kernel contains an integer overflow vulnerability in the createelftables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-754.6.3.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-358.94.1.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-431.93.2.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-504.76.2.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-573.65.2.el6 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-862.14.4.rt56.821.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-862.14.4.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-327.76.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.61.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.43.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 1:3.10.0-693.43.1.rt56.630.el6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b6a2fea39318 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch da029c11e6b1 - Configuration
Enable and install kernel-debuginfo packages (and matching kernel-devel packages) for the kernel being analyzed, as instructed in the Red Hat solution referenced in the material (access.redhat.com/solutions/666123).
SystemTap (requires kernel debug symbols) kernel-debuginfo packages = install and match kernel-devel packages as per Red Hat access.redhat.com/solutions/666123 - Compensating control
Use the provided SystemTap mitigation for CVE-2018-14634: save the SystemTap script to a file with a .stp extension, then generate/load it by running "stap -g [filename-from-step-1].stp" as root (the material also shows "stap -g -p 4 [filename-from-step-1].stp"). The mitigation adjusts the thread's RLIMIT_STACK (rlim_cur) around calls to the vulnerable create_elf_tables() path, clamping with WRITE_ONCE(rlim[RLIMIT_STACK].rlim_cur, limit), to encompass the newly required _STK_LIM / 4 * 3 maximum.
Event History
Parent advisories
This vulnerability appears in the following advisories.