Product:
Linux kernel
Summary
A race condition in mm/gup.c in the Linux kernel allows local users to gain privileges by exploiting incorrect handling of a copy-on-write feature to write to a read-only memory mapping. This vulnerability, known as Dirty COW, was actively exploited in the wild in October 2016. It affects versions 2.x through 4.x before 4.8.3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2016-5195 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system. They can leverage the race condition in the copy-on-write mechanism to modify read-only memory mappings. By carefully timing their actions, the attacker can gain elevated privileges, allowing them to execute arbitrary code with higher permissions than intended.
Affected Products
- Linux kernel 2.x through 4.x before 4.8.3: Vulnerable to privilege escalation due to race condition in memory handling.
Mitigation
To mitigate this vulnerability, users should apply updates as per vendor instructions. It is crucial to ensure that the Linux kernel is updated to version 4.8.3 or later to prevent exploitation of this race condition.