Privilege escalation in Linux kernel - CVE-2016-5195

Vulnerability identifier: #VU1039

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5195

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a  local user to obtain elevated privileges on the target system.
The weakness is due to race condition in the kernel memory subsystem in the management of copy-on-write operations on read-only memory mappings that lets attackers to overwrite kernel memory and gain kernel-level privileges.
Successful exploitation of the vulnerability results in gaining of root privileges on the vulnerable system.

Note: the vulnerability was being actively exploited.

Linux kernel
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE Linux
Ubuntu
Slackware Linux
Opensuse
Fedora

ProtecTIER Entry Edition (PID 5639-PTC) - TS7610 / TS7620
ProtecTIER Gateway for System Z (PID 5639-FPA)
ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G
ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1
Oracle VM Server for x86
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-aarch64 (Red Hat package)
kernel
kernel-alt (Red Hat package)
QRadar Manager for YARA and SIGMA Rules App

Update to version 4.9-rc2.
https://cdn.kernel.org/pub/linux/kernel/v4.x/testing/linux-4.9-rc2.tar.xz

kernel (Red Hat package) - addressed in versions 2.6.18-238.57.1.el5, 2.6.18-348.32.1.el5, 2.6.32-220.68.1.el6, 2.6.32-358.75.1.el6, 2.6.32-431.75.1.el6, 2.6.32-504.54.1.el6, 2.6.32-573.35.2.el6, 2.6.32-642.6.2.el6, 3.10.0-229.42.2.el7, 3.10.0-327.36.3.el7
kernel-rt (Red Hat package) - update to 3.10.0-327.36.3.rt56.238.el7
QRadar Manager for YARA and SIGMA Rules App - update to 2.2.0
kernel-aarch64 (Red Hat package) - update to 4.5.0-15.2.1.el7
kernel - addressed in versions 4.7.9-100.fc23, 4.7.9-200.fc24, 4.8.3-300.fc25
kernel-alt (Red Hat package) - update to 4.11.0-44.4.1.el7a

• Exploit #8672 - DirtyCOW-PoC (An exploit script of CVE-2016-5195) (December 15, 2022)
• Exploit #8088 - dirtycow (Dirty Cow exploit - CVE-2016-5195) (June 29, 2022)
• Exploit #7861 - dirtycow (Dirty Cow exploit - CVE-2016-5195) (May 19, 2022)
• Exploit #5194 - CVE-2016-5195 (DirtyCOW Exploit for Android) (March 7, 2021)
• Exploit #5026 - Dirty-COW-CVE-2016-5195- (Exploit the dirtycow vulnerability to login as root) (January 12, 2021)
• Exploit #5024 - Dirty-COW-CVE-2016-5195- (Exploit the dirtycow vulnerability to login as root) (January 12, 2021)
• Exploit #4971 - rootcow (CVE-2016-5195 exploit) (December 28, 2020)
• Exploit #2651 - Dirty-Cow-CVE-2016-5195- (This is a Dirty Cow (CVE-2016-5195) privilege escalation vulnerability exploit) (May 12, 2020)
• Exploit #2328 - amazon_remove_ads_apk (Android App that removes amazon ads on the lockscreen on motorolla phones using exploit CVE 2016 5195) (April 7, 2020)
• Exploit #2315 - amazon_remove_ads_apk (Android App that removes amazon ads on the lockscreen on motorolla phones using exploit CVE 2016 5195) (April 7, 2020)
• Exploit #1923 - derpyc0w (Example exploit for CVE-2016-5195) (March 18, 2020)
• Exploit #1904 - CVE-2016-5195 (A CVE-2016-5195 exploit example.) (March 18, 2020)
• Exploit #1895 - org.cowpoop.moooooo (Android APK Based On Public Information Using DirtyCOW CVE-2016-5195 Exploit) (March 18, 2020)
• Exploit #1887 - CVE-2016-5195 (Recent Linux privilege escalation exploit) (March 18, 2020)
• Exploit #1881 - dirtycow.cr (CVE-2016-5195 exploit written in Crystal) (March 18, 2020)
• Exploit #107 - labs (Vulnerability Labs for security analysis) (March 18, 2020)
• Exploit #442 - Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access) (March 18, 2020)
• Exploit #441 - Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (SUID) (March 18, 2020)
• Exploit #440 - Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition (PoC) (Write Access) (March 18, 2020)
• Exploit #439 - Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition Privilege Escalation (/etc/passwd) (March 18, 2020)
• Exploit #438 - Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (/etc/passwd) (March 18, 2020)

• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9...

• Privilege escalation in Linux kernel
• Oracle Update for Linux kernel
• Ubuntu update for Linux kernel (Raspberry Pi 2)
• Ubuntu update for Linux kernel (Qualcomm Snapdragon)
• Ubuntu update for Linux kernel (Raspberry Pi 2)
• Ubuntu update for Linux kernel (OMAP4)
• Ubuntu update for Linux kernel (Xenial HWE)
• Ubuntu update for Linux kernel (Trusty HWE)
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• Arch Linux update for linux-grsec
• Arch Linux update for linux
• Arch Linux update for linux-lts
• Slackware Linux update for kernel
• Amazon Linux AMI update for kernel
• Amazon Linux AMI update for kernel
• Red Hat update for Linux Kernel
• Amazon Linux AMI update for kernel
• SUSE Linux update for Linux Kernel Live Patch 13 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 14 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 15 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 12 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 9 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 11 for SLE 12
• SUSE Linux update for Linux Kernel Live Patch 10 for SLE 12
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• Red Hat update for kernel
• Red Hat update for kernel-rt
• Red Hat update for kernel
• Red Hat update for kernel
• Red Hat update for kernel
• OpenSUSE Linux update for kubernetes
• Privilege escalation in IBM ProtecTIER
• Multiple vulnerabilities in QRadar Manager for YARA and SIGMA Rules App
• Fedora 24 update for kernel
• Fedora 23 update for kernel
• Fedora 25 update for kernel
• Red Hat Enterprise Linux 7 update for kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 5 update for kernel
• Red Hat Enterprise Linux 5 update for kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 6 update for kernel
• Red Hat Enterprise Linux 7 update for kernel-aarch64