Skip to content
Fencer Intel
high 7.0

CVE-2018-14633 json

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication…

published 8y ago modified 4mo ago also EUVD-2018-6536

cvss
7.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.7%
EPSS 8.7% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.

Patch / fix

  • linux linux_kernel 3.16.59, 3.18.124, 4.4.159, 4.9.130, 4.14.73, 4.18.11
  • linux Debian 14, Debian 13, Debian 12 4.18.10-1

debian advisories DEBIAN-CVE-2018-14633

  • linux Ubuntu 14.04 LTS 3.13.0-160.210
  • linux Ubuntu 16.04 LTS 4.4.0-137.163
  • linux Ubuntu 18.04 LTS 4.15.0-36.39
  • linux-aws Ubuntu 14.04 LTS 4.4.0-1031.34
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1069.79
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1023.23
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1021.22~16.04.1
  • linux-gcp Ubuntu 18.04 LTS 4.15.0-1021.22

ubuntu advisories UBUNTU-CVE-2018-14633

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel-rt-kvm RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel-rt-trace RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel-rt-debug-kvm RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel-rt-trace-kvm RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel-rt-debuginfo-common-x86_64 RHEL 7 EXTRAS_RT 3.10.0-957.1.3.rt56.913.el7
  • kernel RHEL 7 3.10.0-957.1.3.el7
  • perf RHEL 7 3.10.0-957.1.3.el7

red hat advisories RHSA-2019:1946RHSA-2018:3666RHSA-2018:3651

  • kernel-ec2 SLE Module for Public Cloud 12 3.12.74-60.64.110.1
  • kernel-syms SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.104.1
  • kernel-source SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.104.1
  • kernel-default SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +3 more 4.4.121-92.104.1
  • kgraft-patch-SLE12-SP2_Update_28 SLES for SAP 12 SP2, SLES 12 SP2-LTSS, OpenStack Cloud 7 +1 more 1-3.3.1
  • kernel-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.162-4.19.2
  • kernel-syms-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.162-4.19.1
  • kernel-source-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.162-4.19.1

suse advisories SUSE-SU-2019:1289-1SUSE-SU-2019:0828-1SUSE-SU-2019:0095-1SUSE-SU-2018:3961-1SUSE-SU-2018:3869-1SUSE-SU-2018:3867-1

Is CVE-2018-14633 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-14633 updated cvss 7.0

kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target

  • Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    affected: no fix available
  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-957.1.3.el7, kernel 3.10.0-957.1.3.el7, bpftool 3.10.0-957.1.3.el7, python-perf 3.10.0-957.1.3.el7, kernel-tools 3.10.0-957.1.3.el7, kernel-tools-libs 3.10.0-957.1.3.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.1.3.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-957.1.3.el7, kernel 3.10.0-957.1.3.el7, bpftool 3.10.0-957.1.3.el7, python-perf 3.10.0-957.1.3.el7, kernel-tools 3.10.0-957.1.3.el7, kernel-tools-libs 3.10.0-957.1.3.el7, +2 more
    fixed: vendor fix RHSA-2018:3651
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) perf 3.10.0-693.55.1.el7, kernel 3.10.0-693.55.1.el7, python-perf 3.10.0-693.55.1.el7, kernel-tools 3.10.0-693.55.1.el7, kernel-tools-libs 3.10.0-693.55.1.el7, kernel-abi-whitelists 3.10.0-693.55.1.el7, +1 more
    fixed: vendor fix RHSA-2019:1946
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.1.3.el7
    fixed: vendor fix RHSA-2018:3651
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.55.1.el7
    fixed: vendor fix RHSA-2019:1946
  • Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-957.1.3.rt56.913.el7, kernel-rt-kvm 3.10.0-957.1.3.rt56.913.el7, kernel-rt-trace 3.10.0-957.1.3.rt56.913.el7, kernel-rt-debug-kvm 3.10.0-957.1.3.rt56.913.el7, kernel-rt-trace-kvm 3.10.0-957.1.3.rt56.913.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-957.1.3.rt56.913.el7 Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-957.1.3.rt56.913.el7, kernel-rt-trace 3.10.0-957.1.3.rt56.913.el7
    fixed: vendor fix RHSA-2018:3666
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-957.1.3.el7, kernel 3.10.0-957.1.3.el7, bpftool 3.10.0-957.1.3.el7, python-perf 3.10.0-957.1.3.el7, kernel-kdump 3.10.0-957.1.3.el7, kernel-tools 3.10.0-957.1.3.el7, +7 more
    fixed: vendor fix RHSA-2018:3651
show 5 more
  • Red Hat Enterprise Linux Server EUS (v. 7.4) perf 3.10.0-693.55.1.el7, kernel 3.10.0-693.55.1.el7, python-perf 3.10.0-693.55.1.el7, kernel-kdump 3.10.0-693.55.1.el7, kernel-tools 3.10.0-693.55.1.el7, kernel-tools-libs 3.10.0-693.55.1.el7, +6 more
    fixed: vendor fix RHSA-2019:1946
  • Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-957.1.3.el7, kernel-debuginfo-common-x86_64 3.10.0-957.1.3.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.1.3.el7
    fixed: vendor fix RHSA-2018:3651
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.4) kernel-debuginfo-common-ppc64 3.10.0-693.55.1.el7, kernel-debuginfo-common-x86_64 3.10.0-693.55.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.55.1.el7
    fixed: vendor fix RHSA-2019:1946
  • Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-957.1.3.el7, kernel 3.10.0-957.1.3.el7, bpftool 3.10.0-957.1.3.el7, python-perf 3.10.0-957.1.3.el7, kernel-tools 3.10.0-957.1.3.el7, kernel-tools-libs 3.10.0-957.1.3.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.1.3.el7
    fixed: vendor fix RHSA-2018:3651
  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-core, kernel-tools, python3-perf, +17 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.74% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 7.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD 3.1 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD 2.0 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C

Affected products

  • The Linux Foundation kernel

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.