CVE-2016-5195
Linux Kernel Race Condition Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
- CVSS 3.1
- 7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 83.52% probability · 100th percentile
- Public exploits
- 5 in Exploit-DB · verified · first 19 October 2016
- CISA KEV
- Listed 3 March 2022 · due 24 March 2022
- Weakness
- CWE-362
- Affected
- canonical/ubuntu linux · linux/linux kernel · redhat/enterprise linux · redhat/enterprise linux aus · redhat/enterprise linux eus · redhat/enterprise linux long life · redhat/enterprise linux tus · debian/debian linux · fedoraproject/fedora · paloaltonetworks/pan-os · netapp/cloud backup · netapp/hci storage nodes · netapp/oncommand balance · netapp/oncommand performance manager · netapp/oncommand unified manager for clustered data ontap · netapp/ontap select deploy administration utility · netapp/snapprotect · netapp/solidfire
- Source
- chrome-cve-admin@google.com
EPSS 83.5% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-5195
Public exploits (5)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-40839source ↗ | Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)linux · FireFart | local | 28 November 2016 | yes |
| EDB-40847source ↗ | Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)linux · Gabriele Bonacini | local | 27 November 2016 | yes |
| EDB-40838source ↗ | Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)linux · Phil Oester | local | 26 October 2016 | no |
| EDB-40616source ↗ | Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)linux · Robin Verton | local | 21 October 2016 | yes |
| EDB-40611source ↗ | Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)linux · Phil Oester | local | 19 October 2016 | yes |
References
- http://fortiguard.com/advisory/FG-IR-16-063Third Party Advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619Issue Tracking, Patch, Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00040.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00045.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00048.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00049.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00050.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00051.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00052.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00053.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00054.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00055.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00056.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00057.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00058.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00063.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00064.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00065.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00066.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00067.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00072.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00033.htmlMailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.