CVE-2016-5195 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-o...
HighCVSS 7.0
EPSS 83.5%
CISA KEV
added 2022-03-03 · due 2022-03-24
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.7.8-1 | 4.7.8-1 |
| debian/linux(Debian:13) | < 4.7.8-1 | 4.7.8-1 |
| debian/linux(Debian:14) | < 4.7.8-1 | 4.7.8-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.10 | No fix listed |
| Linux kernel | >= 2.6.22, < 3.2.83 | 3.2.83 |
| Linux kernel | >= 3.3, < 3.4.113 | 3.4.113 |
| Linux kernel | >= 3.5, < 3.10.104 | 3.10.104 |
| Linux kernel | >= 3.11, < 3.12.66 | 3.12.66 |
| Linux kernel | >= 3.13, < 3.16.38 | 3.16.38 |
| Linux kernel | >= 3.17, < 3.18.44 | 3.18.44 |
| Linux kernel | >= 3.19, < 4.1.35 | 4.1.35 |
| Linux kernel | >= 4.2, < 4.4.26 | 4.4.26 |
| Linux kernel | >= 4.5, < 4.7.9 | 4.7.9 |
| Linux kernel | >= 4.8, < 4.8.3 | 4.8.3 |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux aus | = 6.2 | No fix listed |
| redhat enterprise linux aus | = 6.4 | No fix listed |
| redhat enterprise linux aus | = 6.5 | No fix listed |
| redhat enterprise linux eus | = 6.6 | No fix listed |
| redhat enterprise linux eus | = 6.7 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux eus | = 7.1 | No fix listed |
| redhat enterprise linux long life | = 5.6 | No fix listed |
| redhat enterprise linux long life | = 5.9 | No fix listed |
| redhat enterprise linux tus | = 6.5 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
| paloaltonetworks pan-os | >= 5.1, < 7.0.14 | 7.0.14 |
| paloaltonetworks pan-os | >= 7.1.0, < 7.1.8 | 7.1.8 |
| netapp cloud backup | All versions | No fix listed |
| netapp hci storage nodes | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand unified manager for clustered data ontap | All versions | No fix listed |
| netapp ontap select deploy administration utility | All versions | No fix listed |
| netapp snapprotect | All versions | No fix listed |
| netapp solidfire | All versions | No fix listed |
References
- Debian Security Tracker CVE-2016-5195 issue-tracking third-party-advisory vendor-advisory
- fortiguard.com third-party-advisory
- git.kernel.org issue-tracking patch vendor-advisory
- kb.juniper.net third-party-advisory
- kb.juniper.net third-party-advisory
- kb.juniper.net third-party-advisory
- openSUSE-SU-2016:2583 mailing-list vendor-advisory
- openSUSE-SU-2016:2584 mailing-list vendor-advisory
- SUSE-SU-2016:2585 mailing-list vendor-advisory
- SUSE-SU-2016:2592 mailing-list vendor-advisory
- SUSE-SU-2016:2593 mailing-list vendor-advisory
- SUSE-SU-2016:2596 mailing-list vendor-advisory
- SUSE-SU-2016:2614 mailing-list vendor-advisory
- openSUSE-SU-2016:2625 mailing-list vendor-advisory
- SUSE-SU-2016:2629 mailing-list vendor-advisory
- SUSE-SU-2016:2630 mailing-list vendor-advisory
- SUSE-SU-2016:2631 mailing-list vendor-advisory
- SUSE-SU-2016:2632 mailing-list vendor-advisory
- SUSE-SU-2016:2633 mailing-list vendor-advisory
- SUSE-SU-2016:2634 mailing-list vendor-advisory
- SUSE-SU-2016:2635 mailing-list vendor-advisory
- SUSE-SU-2016:2636 mailing-list vendor-advisory
- SUSE-SU-2016:2637 mailing-list vendor-advisory
- SUSE-SU-2016:2638 mailing-list vendor-advisory
- openSUSE-SU-2016:2649 mailing-list vendor-advisory
- SUSE-SU-2016:2655 mailing-list vendor-advisory
- SUSE-SU-2016:2657 mailing-list vendor-advisory
- SUSE-SU-2016:2658 mailing-list vendor-advisory
- SUSE-SU-2016:2659 mailing-list vendor-advisory
- SUSE-SU-2016:2673 mailing-list vendor-advisory
- SUSE-SU-2016:3069 mailing-list vendor-advisory
- SUSE-SU-2016:3304 mailing-list vendor-advisory
- openSUSE-SU-2020:0554 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com third-party-advisory vdb-entry
- RHSA-2016:2098 third-party-advisory vendor-advisory
- RHSA-2016:2105 third-party-advisory vendor-advisory
- RHSA-2016:2106 third-party-advisory vendor-advisory
- RHSA-2016:2107 third-party-advisory vendor-advisory
- RHSA-2016:2110 third-party-advisory vendor-advisory
- RHSA-2016:2118 third-party-advisory vendor-advisory
- RHSA-2016:2120 third-party-advisory vendor-advisory
- RHSA-2016:2124 third-party-advisory vendor-advisory
- RHSA-2016:2126 third-party-advisory vendor-advisory
- RHSA-2016:2127 third-party-advisory vendor-advisory
- RHSA-2016:2128 third-party-advisory vendor-advisory
- RHSA-2016:2132 third-party-advisory vendor-advisory
- RHSA-2016:2133 third-party-advisory vendor-advisory
- 20161026 Vulnerability in Linux Kernel Affecting Cisco Products: October 2016 third-party-advisory vendor-advisory
- DSA-3696 third-party-advisory vendor-advisory
- www.huawei.com third-party-advisory
- www.kernel.org release-notes
- [oss-security] 20161021 CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerability mailing-list third-party-advisory
- [oss-security] 20161026 Re: CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerability mailing-list third-party-advisory
- [oss-security] 20161027 CVE-2016-5195 test case mailing-list third-party-advisory
- [oss-security] 20161030 Re: CVE-2016-5195 test case mailing-list third-party-advisory
- [oss-security] 20161103 Re: CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerability mailing-list third-party-advisory
- [oss-security] 20220307 CVE-2022-0847: Linux kernel: overwriting read-only files mailing-list third-party-advisory
- [oss-security] 20220808 CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- [oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- [oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- [oss-security] 20220808 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- [oss-security] 20220809 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- [oss-security] 20220815 Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions mailing-list third-party-advisory
- www.oracle.com patch third-party-advisory
- 20161020 [CVE-2016-5195] "Dirty COW" Linux privilege escalation vulnerability broken-link mailing-list third-party-advisory vdb-entry
- 20170310 [security bulletin] HPESBGN03707 rev.1 - HPE ConvergedSystem 700 2.0 VMware Kit, Remote Increase of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 20170331 [security bulletin] HPESBGN03722 rev.1 - HPE Operations Agent, Local Escalation of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 20170615 [security bulletin] HPESBGN03761 rev.1 - HPE Virtualization Performance Viewer (VPV)/ Cloud Optimizer using Linux, Remote Escalation of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 20161020 [CVE-2016-5195] "Dirty COW" Linux privilege escalation vulnerability broken-link mailing-list third-party-advisory vdb-entry
- 20170310 [security bulletin] HPESBGN03707 rev.1 - HPE ConvergedSystem 700 2.0 VMware Kit, Remote Increase of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 20170331 [security bulletin] HPESBGN03722 rev.1 - HPE Operations Agent, Local Escalation of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 20170615 [security bulletin] HPESBGN03761 rev.1 - HPE Virtualization Performance Viewer (VPV)/ Cloud Optimizer using Linux, Remote Escalation of Privilege broken-link mailing-list third-party-advisory vdb-entry
- 93793 broken-link third-party-advisory vdb-entry
- 1037078 broken-link third-party-advisory vdb-entry
- USN-3104-1 third-party-advisory vendor-advisory
- USN-3104-2 third-party-advisory vendor-advisory
- USN-3105-1 third-party-advisory vendor-advisory
- USN-3105-2 third-party-advisory vendor-advisory
- USN-3106-1 third-party-advisory vendor-advisory
- USN-3106-2 third-party-advisory vendor-advisory
- USN-3106-3 third-party-advisory vendor-advisory
- USN-3106-4 third-party-advisory vendor-advisory
- USN-3107-1 third-party-advisory vendor-advisory
- USN-3107-2 third-party-advisory vendor-advisory
- RHSA-2017:0372 broken-link third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory
- access.redhat.com third-party-advisory
- bto.bluecoat.com permissions-required third-party-advisory
- bugzilla.redhat.com exploit issue-tracking
- bugzilla.suse.com issue-tracking
- dirtycow.ninja third-party-advisory
- github.com third-party-advisory
- github.com exploit third-party-advisory
- github.com issue-tracking patch
- h20566.www2.hpe.com third-party-advisory