For timely vulnerability information, unofficial sources are a better bet
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… |
Full article443 words · extracted from helpnetsecurity.com · click to collapse
From over 12,500 disclosed Common Vulnerabilities and Exposures (CVEs), more than 75% were publicly reported online before they were published to the NIST’s centralized National Vulnerability Database (NVD), Recorded Future researchers have found.
The data, taken from the beginning of 2016, showed that the median lag was seven days between a CVE being revealed to ultimately being published on the NIST’s NVD. This time lag also significantly differed between vendor announcements and NVD publishing, with the fastest on average one day later and the slowest published with a 172 day average delay.
Sources of CVE online reporting include easily accessible sites such as news media, blogs, and social media pages as well as more remote areas of the web including the dark web, paste sites, and criminal forums. Additionally, the vulnerability content available on the dark web illustrates that the adversary community is actively monitoring and acting on the broad set of sources initially releasing vulnerability information.
Additional key findings from the research revealed:
- More than 1,500 sources reported on vulnerabilities prior to release, including information security sources like blogs or social feeds and adversary sources on the dark web.
- 5% of vulnerabilities are detailed in dark web prior to NVD release and these have higher severity levels than expected.
- 30% of vulnerabilities published to the dark web were in foreign languages.
- In the case of the Dirty-Cow vulnerability (CVE-2016-5195), the proof-of-concept (POC) was posted to Pastebin 15 days before NVD publication. The original security report was translated to Russian and posted on an exploit forum two days after the report was first released.
- Over 500 CVEs first reported online in 2016 are still awaiting NVD publication.
- Adversaries (exploit writers) aren’t shy about explicitly using the CVE identifier as they are doing their work.
As demonstrated with the recent global WannaCry ransomware attack, many organizations, particularly when a CVE is first publicized in media outlets, hit the panic button to issue a patch based on a reported number of systems affected by any given CVE.
The recommended best practices for organizations are to adopt a proactive and risk-based approach to addressing vulnerabilities, and to utilize intelligence from sites that are more difficult to access, such as the dark web, but that are the first to see chatter on new threats and potential zero-days.
Security teams need to look at whether the CVE could affect them, assess their appetite for risk, and then only focus on the CVEs that have the highest risk of being exploited. By building a more comprehensive set of risk rules, based on applied intelligence from both friendly and adversary sources, organizations can make infinitely more informed strategic security decisions.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/06/07/timely-vulnerability-information/