CVE-2016-5195

Linux Kernel Race Condition

7.0 HIGHActively exploited (CISA KEV)Public exploitEPSS 83.5%

Published10 Nov 2016
Added to CISA KEV3 Mar 2022
Remediation due24 Mar 2022

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Netapp Cloud Backupall versions

Netapp Hci Storage Nodesall versions

Netapp Oncommand Balanceall versions

Netapp Oncommand Performance Managerall versions

Netapp Oncommand Unified Manager For Clustered Data Ontapall versions

Netapp Ontap Select Deploy Administration Utilityall versions

Netapp Snapprotectall versions

Netapp Solidfireall versions

Canonical Ubuntu Linux12.04 · 14.04 · 16.04 · 16.10

Debian Linux7.0 · 8.0

Fedoraproject Fedora23 · 24 · 25

Linux Kernel≥ 2.6.22 < 3.2.83 · ≥ 3.11 < 3.12.66 · ≥ 3.13 < 3.16.38 · ≥ 3.17 < 3.18.44

Palo Alto Networks PAN-OS≥ 5.1 < 7.0.14 · ≥ 7.1.0 < 7.1.8

Redhat Enterprise Linux5 · 6.0 · 7.0

Redhat Enterprise Linux Aus6.2 · 6.4 · 6.5

Redhat Enterprise Linux Eus6.6 · 6.7 · 7.1

Redhat Enterprise Linux Long Life5.6 · 5.9

Redhat Enterprise Linux Tus6.5

Remediation

Fixed in

Linux Kernel≥ 3.2.83

Palo Alto Networks PAN-OS≥ 7.0.14

Patch & vendor advisories

References

http://fortiguard.com/advisory/FG-IR-16-063Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619Issue TrackingPatchVendor Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.htmlMailing List

and 118 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-5195 being actively exploited?

Yes. CVE-2016-5195 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022.

How severe is CVE-2016-5195?

CVE-2016-5195 has a CVSS 3.1 base score of 7.0, rated high. EPSS estimates a 83.5% probability of exploitation.

Which products are affected by CVE-2016-5195?

Affected products include Netapp Cloud Backup, Netapp Hci Storage Nodes, Netapp Oncommand Balance, Netapp Oncommand Performance Manager, Netapp Oncommand Unified Manager For Clustered Data Ontap, and 13 more.

How do I fix CVE-2016-5195?

Upgrade affected software to a fixed version, for example Linux Kernel 3.2.83, Palo Alto Networks PAN-OS 7.0.14 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-5195 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.