Stable Linux Kernel Updates Roll Out To Address "Dirty COW" CVE
Written by Michael Larabel in Linux Kernel on 20 October 2016 at 09:53 AM EDT. 7 Comments
LINUX KERNEL --
The supported Linux 4.8/4.7/4.4 kernel series have seen stable point releases today to address a new CVE security issue nicknamed "Dirty COW" that is a local privilege escalation issue and could allow attackers to overwrite files to which they don't own write access.

CVE-2016-5195 was made public overnight as a kernel local privilege escalation issue. As described, "A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. This could be abused by an attacker to modify existing setuid files with instructions to elevate privileges. An exploit using this technique has been found in the wild."

The fresh releases of Linux 4.8.3, 4.7.9, and 4.4.26 address this CVE. There's also a DirtyCOW.ninja site setup devoted to this bug, following recent security nicknames like Heartbleed, Shellshock, etc.

In the upstream kernel fix, Linus Torvalds describes this as an "ancient bug" dating back many years.

About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Linux Kernel News
Popular News