36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# CVE-2016-5195: "Dirty COW": race condition in copy-on-write handling of private read-only mappings
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
CVSS 7.0-7.2. Fixed in Linux 4.8.3 (and backported to every maintained branch since).
|
|
|
|
## Source
|
|
|
|
- [Ubuntu advisory](https://ubuntu.com/security/CVE-2016-5195)
|
|
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2016-5195)
|
|
|
|
## Relevance to doos
|
|
|
|
A race in the memory manager's copy-on-write handling let a local user write to memory
|
|
that should have been read-only, including on-disk binaries mapped read-only. Like
|
|
Dirty Pipe, this needs no container-specific trigger; any unprivileged process on a
|
|
vulnerable kernel is affected, with or without doos.
|
|
|
|
|
|
## What the check does
|
|
|
|
Kernel version only. Fixed in 4.8.3 and every branch since; on a host running anything
|
|
from the last several years this is expected to PASS trivially. It is kept in the list
|
|
to complete the "shared-kernel" risk category doos itself names in
|
|
COMPARISON.md section 6, not because it is expected to ever FAIL on a maintained host.
|
|
|
|
|
|
## Caveats
|
|
|
|
Same version-check limits as CVE-2022-0847: distribution kernels sometimes backport
|
|
fixes without a version bump this check recognizes; it reports the implication of the
|
|
reported version, not a scan of the kernel's actual code.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|