Executive brief
A vulnerability in the Linux kernel could allow a standard user to gain full administrative control over a system. By exploiting a flaw in how the system handles internal memory tables, an attacker who already has basic access can bypass security restrictions. This could lead to unauthorized data access, system-wide changes, or a complete takeover of the affected server or device.
Technical details
An integer overflow vulnerability (CWE-190) exists in the create_elf_tables() function within the Linux kernel. The flaw is triggered when the kernel allocates memory for argument and environment pointers during the execution of a new binary. A local, unprivileged attacker can exploit this by passing a large number of arguments to a SUID or otherwise privileged binary, leading to a buffer overflow that can overwrite memory and grant root privileges. The vulnerability affects kernel versions 2.6.x, 3.10.x, and 4.14.x, and has been observed in active exploitation. Patches are available from major Linux distributions and affected vendors like F5 and NetApp.
Affected products
- Linux Linux Kernel 2.6.x, 3.10.x, 4.14.x
- F5 BIG-IP 13.0.0 to 13.1.1.5
Timeline
- 2018-09-25: disclosed: Public disclosure via oss-security mailing list
- 2018-09-25: patched: Red Hat and other vendors released security advisories and patches
- 2026-01-26: kev added: Added to CISA Known Exploited Vulnerabilities catalog