OSG-SEC-2018-10-02 Vulnerability in Linux kernel's create_elf_tables() function
Dear OSG Security Contacts,
A new integer overflow vulnerability described in CVE-2018-14634  has been reported in the Linux kernel's create_elf_tables() function that could potentially allow an attacker to escalate privileges. This vulnerability only applies to systems with more than 32GB of memory and on which users can allocate 32GB. OSG security team considers patching this vulnerability to be IMPORTANT.
Kernel versions 2.6.x, 3.10.x and 4.14.x. are affected. 
Patches are available for the following operating systems and OSG Security team advises sites to apply the patch as soon as possible. Please note that patches are still not available for Red Hat Enterprise Linux 6 and Scientific Linux 6. Please pay attention to vendor advisories for patches to those systems.
RedHat Linux: - RHEL7 (kernel): https://access.redhat.com/errata/RHSA-2018:2748
Scientific Linux: - SL 7 (kernel): https://www.scientificlinux.org/category/sl-errata/slsa-20182748-1/
HOW IT WORKS:
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. This issue does not affect 32-bit systems as they do not have a large enough memory address space to exploit this flaw. 
-  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14634
-  https://access.redhat.com/security/cve/cve-2018-14634
Please contact the OSG security team at secu[email protected] if you have any questions or concerns.
OSG Security Team