Known exploited vulnerability
CVE-2016-5195
The short answer
CVE-2016-5195 affects n/a n/a and is rated high (CVSS 7.0). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03: attackers are using it, so patch it first. The vendor has linked a patch.
What it is
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Weakness: CWE-362.
Severity
7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since Mar 3, 2022
Federal due date Mar 24, 2022
EPSS, next 30 days
84%
Higher than 100% of scored CVEs
How it can be exploited
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
Apply updates per vendor instructions.
Affected products
n/a. NVD's record lists the exact affected versions.
References
- access.redhat.com/errata/RHSA-2017:0372 Broken LinkThird Party Advisory
- access.redhat.com/security/cve/cve-2016-5195 Third Party Advisory
- access.redhat.com/security/vulnerabilities/2706661 Third Party Advisory
- bto.bluecoat.com/security-advisory/sa134 Permissions RequiredThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1384344 ExploitIssue Tracking
- bugzilla.suse.com/show_bug.cgi?id=1004418 Issue Tracking
- dirtycow.ninja Third Party Advisory
- github.com/dirtycow/dirtycow.github.io/wiki/PoCs Third Party Advisory
- github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails ExploitThird Party Advisory
- github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 Issue TrackingPatch
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05352241 Third Party Advisory
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03707en_us Third Party Advisory
Questions
Is CVE-2016-5195 being exploited?
Yes. CISA added CVE-2016-5195 to its Known Exploited Vulnerabilities catalog on 2022-03-03, with a federal remediation due date of 2022-03-24.
How do I fix CVE-2016-5195?
CISA's required action: Apply updates per vendor instructions.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Linux exploited vulnerabilities
Everything CISA lists as exploited for Linux.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.