Dirty COW Linux kernel zero-day exploited in the wild is now patched
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… |
Full article452 words · extracted from helpnetsecurity.com · click to collapse
Linux developer Phil Oester has spotted attackers exploiting a Linux kernel zero-day privilege escalation flaw that dates back to 2007, and has raised the alarm.
The vulnerability (CVE-2016-5195) has been dubbed Dirty COW by a community-maintained project that took it upon themselves to raise its visibility by appending a name and logo, despite their dislike of “branded” vulnerabilities.
Why was it named so?
Because, as explained by Red Hat developers, the source of the flaw is a race condition in the way the Linux kernel’s memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings.
“Exploitation of this bug does not leave any trace of anything abnormal happening to the logs,” the Dirty COW project noted. Phil Oester spotted the exploit as it was uploaded to one of its webservers.
“For the past few years, I have been capturing all inbound traffic to my webservers for forensic analysis. This practice has proved invaluable on numerous occasions, and I would recommend it to all admins. In this case, I was able to extract the uploaded binary from those captures to analyze its behavior, and escalate to the appropriate Linux kernel maintainers,” he told Ars Technica.
“The vulnerability is easiest exploited with local access to a system such as shell accounts. Less trivially, any web server/application vulnerability which allows the attacker to upload a file to the impacted system and execute it also works,” he added.
A partial exploit has been made available by the project, and a full exploit to security researchers, but you can bet anything on the fact that a full exploit will soon trickle down to potential attackers.
Exploitation of the flaw could allow attackers to achieve root access on vulnerable systems.
Dirty COW has been patched
The flaw has now been patched by Linux kernel maintainers. In fact, this bug was not unknown to them. Linus Torvalds said that he attempted to fix the flaw eleven years ago, but the fix was undone due to other problems. So, the bug is apparently even older than first believed.
Oester says all Linux users need to take this bug very seriously, and patch their systems as soon as possible.
Red Hat, Debian and Ubuntu developers have already pushed out a patch, and others Linux distros that supply the kernel to its users are expected to follow.
According to The Register, the flaw is also present in Android, as it is based on the Linux kernel.
Many embedded devices (routers, Wi-Fi access points, NAS appliances, smart TVs, and so on) are also based on it, and that’s going to be a much bigger problem – many manifacturers are slow and/or lax at pushing out security updates for their products.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2016/10/21/dirty-cow-linux-kernel-zero-day/