Detect Linux Kernel Integer Overflow in create_elf_tables (CVE-2018-14634) in IBM QRadar
CVE-2018-14634 is an integer overflow vulnerability in the Linux kernel's create_elf_tables() function, triggered during process execution via the execve syscall. A local unprivileged attacker can exploit this flaw to achieve privilege escalation to root by crafting a binary with an extremely large argument list. This vulnerability exists in Linux kernel versions 2.6.x through 4.14.x and is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Privilege Escalation
QRadar Detection Query
SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
sourceip, username, "Process Name", "Command",
QIDNAME(qid) as EventName
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Audit')
AND ("syscall" = 'execve' OR "Process Name" IN ('bash','sh','dash','python','python3','perl','ksh','zsh'))
AND username NOT IN ('root','daemon','nobody','www-data')
AND sourceip IN
(SELECT sourceip FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Audit')
AND ("syscall" IN ('setuid','setreuid','setresuid') AND "euid" = '0')
AND DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('minute', -5, NOW())
GROUP BY sourceip)
GROUP BY sourceip, username, "Process Name", "Command"
HAVING COUNT(*) > 0
LAST 3600 SECONDSQRadar AQL query correlating execve syscall activity from non-root users with subsequent setuid-family syscalls resulting in effective root (euid=0) on the same host within a 5-minute window, targeting CVE-2018-14634 exploitation patterns.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate privilege escalation tools like sudo or pkexec
- System initialization scripts that transition from service accounts to root
- Security scanning tools that test privilege boundaries
- Automated patching or update systems performing privileged operations
Other platforms for CVE-2018-14634
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Large Argument execve Invocation
Expected signal: Auditd logs an execve syscall record with an unusually large a1 or args array. Process creation event logged with high argument count.
- Test 2Check for Vulnerable Kernel Version
Expected signal: Process execution of uname and package manager commands logged via auditd or endpoint telemetry.
- Test 3Exploit Binary Drop and Execute Simulation (Lab Only)
Expected signal: File creation in /tmp, chmod syscall, bash script execution, and id command execution all logged via auditd. File write to /tmp from a non-root user.
Response Playbook
Triage
- Identify the affected host and confirm the kernel version is vulnerable (Linux kernel 2.6.x through 4.14.x, before patches for CVE-2018-14634 were applied). Run `uname -r` on the endpoint.
- Determine the originating user account that executed the suspicious process. Verify whether this account is authorized for the observed level of privilege escalation.
- Review /var/log/audit/audit.log or journalctl for execve syscall records with abnormal argument counts immediately preceding any setuid/setreuid/setresuid calls resulting in euid=0.
- Check for the presence of known public exploit binaries (e.g., files referencing 'create_elf_tables', 'mutagen-astronomy') in /tmp, /dev/shm, or user home directories.
- Assess whether the system has been patched: compare kernel version against vendor advisories (RHSA-2018:3540 for RHEL/CentOS or equivalent distro advisories).
Containment
- Immediately isolate the affected host from the network to prevent lateral movement if active exploitation is confirmed. Use EDR network containment or firewall rules to block all outbound connections.
- Terminate any suspicious root-owned processes spawned by non-root users. Kill the offending PIDs and revoke any active sessions for the compromised user account.
- Force a kernel update to a patched version and reboot the system. Coordinate with the change management process if in a production environment.
Evidence Collection
- Capture a memory image of the affected system before rebooting to preserve exploit artifacts, injected shellcode, and any modified kernel structures. Use tools such as LiME (Linux Memory Extractor).
- Collect auditd logs (/var/log/audit/audit.log), /proc/[pid]/cmdline for suspicious processes, bash history files for all users, and any binaries found in world-writable directories (/tmp, /dev/shm, /var/tmp).
Escalation Criteria
- !Escalate immediately if root access has been confirmed for an account that should not have it, or if persistence mechanisms (new cron jobs, SSH keys, SUID binaries) have been detected post-exploitation.
- !Escalate to incident response if multiple hosts in the environment show the same exploitation pattern, suggesting automated or worm-like propagation of the privilege escalation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Auditd records for execve syscalls with arg0 length anomalies or unusually high argument counts preceding setuid-family syscalls resulting in euid=0 - >
Files in /tmp, /dev/shm, or /var/tmp with SUID bits or names matching known exploit tools (e.g., 'mutagen-astronomy', 'exploit', 'pwn') - >
Modified /etc/passwd or /etc/sudoers entries added after the exploitation window - >
New SSH authorized_keys entries in /root/.ssh/ or other user home directories - >
Kernel ring buffer output (dmesg) showing memory corruption warnings or BUG: unable to handle kernel paging request errors
Tuning Guidance
Reduce false positives by baselining which non-root accounts legitimately spawn privileged processes in your environment (e.g., accounts using sudo wrappers or setuid binaries). Add these to allowlists scoped to specific binary paths. Increase confidence by requiring that the privilege escalation result in an interactive root shell (pts/ or tty allocation) rather than a background daemon. On heavily patched environments running kernel 4.15+, consider lowering the priority of this detection while retaining it for legacy host groups. Correlate with vulnerability scanner data to limit alerting to hosts confirmed to be running unpatched kernel versions.
Hunting Queries
Hunt for kernel panic or memory corruption messages in syslog that may indicate failed or successful exploit attempts against CVE-2018-14634, which can trigger kernel faults when the integer overflow corrupts stack memory.
Syslog
| where Facility == "kern" or ProcessName == "kernel"
| where SyslogMessage has_any ("general protection fault", "BUG:", "kernel BUG", "unable to handle kernel", "Oops")
| where TimeGenerated > ago(7d)
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated descindex=linux_syslog sourcetype=syslog ("general protection fault" OR "kernel BUG" OR "unable to handle kernel" OR "Oops: 0002")
| stats count min(_time) as first_seen max(_time) as last_seen by host, _raw
| sort - countAtomic Red Team Tests
Simulates the precondition for CVE-2018-14634 by invoking a process with an abnormally large number of arguments, similar to what the exploit uses to trigger the integer overflow in create_elf_tables. Safe to run; does not exploit the kernel.
Command
python3 -c "import os, sys; args = ['/bin/echo'] + ['A'*4096]*200; os.execv('/bin/echo', args)" 2>&1 || trueCleanup
No cleanup required; process exits immediately.Expected Telemetry
Auditd logs an execve syscall record with an unusually large a1 or args array. Process creation event logged with high argument count.
Expected Detection
SPL and EQL queries filtering on args_count > 100 or argument string length anomalies should trigger on this event.
Identifies whether the target system is running a kernel version potentially vulnerable to CVE-2018-14634 (Linux 2.6.x through 4.14.x before vendor patches).
Command
KVER=$(uname -r); echo "Kernel: $KVER"; dpkg -l linux-image-* 2>/dev/null | grep ii || rpm -qa kernel 2>/dev/null; echo 'Check vendor advisory for patch status'Cleanup
No cleanup required.Expected Telemetry
Process execution of uname and package manager commands logged via auditd or endpoint telemetry.
Expected Detection
Reconnaissance-style enumeration of kernel version may trigger host-based anomaly detection if paired with subsequent exploitation activity.
Simulates the attacker workflow of dropping an exploit binary into /tmp and executing it as a non-root user, as seen in real-world CVE-2018-14634 exploitation. In a patched lab environment, the exploit will fail gracefully without achieving root.
Command
cd /tmp && cat > fake_exploit.sh << 'EOF'
#!/bin/bash
echo '[*] CVE-2018-14634 simulation - not a real exploit'
echo '[*] Would attempt: create_elf_tables integer overflow'
id
EOF
chmod +x fake_exploit.sh && ./fake_exploit.sh; rm -f fake_exploit.shCleanup
rm -f /tmp/fake_exploit.shExpected Telemetry
File creation in /tmp, chmod syscall, bash script execution, and id command execution all logged via auditd. File write to /tmp from a non-root user.
Expected Detection
EDR and auditd-based detections should flag script creation in /tmp followed by immediate execution, particularly if paired with id or whoami commands typical of post-exploitation verification.