Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect h…

Published 9 y ago 2016-11-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.0

v3.1 · CNA

CISA KEV

Yes

added 2022-03-03

EPSS

83.5%

percentile 100%

Public exploits

Exploit-DB

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Known exploited (CISA KEV)

Added: 4 y ago 2022-03-03
Due date: 2022-03-24 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: Linux / Kernel
CISA name: Linux Kernel Race Condition Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: no
Technical impact: total
Assessed: 21 mo ago 2025-01-29

Exploit prediction (EPSS)

83.52% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

EDB-40847 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method) · local · 2016-11-27
EDB-40839 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) · local · 2016-11-28
EDB-40838 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method) · local · 2016-10-26
EDB-40616 Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method) · local · 2016-10-21
EDB-40611 Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method) · local · 2016-10-19

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.0	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	7.0	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	7.0	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.2	`AV:L/AC:L/Au:N/C:C/I:C/A:C`

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

Technology feeds

Palo Alto PAN-OS (RSS, critical only) · Linux kernel (RSS, critical only)

References

rhn.redhat.com /errata/RHSA-2016-2107.html · vendor-advisory, x_refsource_REDHAT, x_transferred
exploit-db.com /exploits/40616/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
access.redhat.com /errata/RHSA-2017:0372 · vendor-advisory, x_refsource_REDHAT, x_transferred
bto.bluecoat.com /security-advisory/sa134 · x_refsource_CONFIRM, x_transferred
h20566.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05352241 · x_refsource_CONFIRM, x_transferred
oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
exploit-db.com /exploits/40839/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
dirtycow.ninja · x_refsource_MISC, x_transferred
exploit-db.com /exploits/40847/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
rhn.redhat.com /errata/RHSA-2016-2118.html · vendor-advisory, x_refsource_REDHAT, x_transferred
rhn.redhat.com /errata/RHSA-2016-2128.html · vendor-advisory, x_refsource_REDHAT, x_transferred
source.android.com /security/bulletin/2016-12-01.html · x_refsource_CONFIRM, x_transferred
rhn.redhat.com /errata/RHSA-2016-2120.html · vendor-advisory, x_refsource_REDHAT, x_transferred
openwall.com /lists/oss-security/2016/10/26/7 · mailing-list, x_refsource_MLIST, x_transferred
rhn.redhat.com /errata/RHSA-2016-2133.html · vendor-advisory, x_refsource_REDHAT, x_transferred
rhn.redhat.com /errata/RHSA-2016-2098.html · vendor-advisory, x_refsource_REDHAT, x_transferred
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03761en_us · x_refsource_CONFIRM, x_transferred
kb.cert.org /vuls/id/243144 · third-party-advisory, x_refsource_CERT-VN, x_transferred
bugzilla.suse.com /show_bug.cgi?id=1004418 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1037078 · vdb-entry, x_refsource_SECTRACK, x_transferred
people.canonical.com /~ubuntu-security/cve/2016/CVE-2016-5195.html · x_refsource_CONFIRM, x_transferred
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03722en_us · x_refsource_CONFIRM, x_transferred
security.netapp.com /advisory/ntap-20161025-0001/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/93793 · vdb-entry, x_refsource_BID, x_transferred
rhn.redhat.com /errata/RHSA-2016-2127.html · vendor-advisory, x_refsource_REDHAT, x_transferred
security-tracker.debian.org /tracker/CVE-2016-5195 · x_refsource_CONFIRM, x_transferred
github.com /dirtycow/dirtycow.github.io/wiki/PoCs · x_refsource_MISC, x_transferred
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03742en_us · x_refsource_CONFIRM, x_transferred
github.com /torvalds/linux/commit/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 · x_refsource_CONFIRM, x_transferred
help.ecostruxureit.com /display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes · x_refsource_CONFIRM, x_transferred
github.com /dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails · x_refsource_MISC, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=1384344 · x_refsource_CONFIRM, x_transferred
access.redhat.com /security/vulnerabilities/2706661 · x_refsource_CONFIRM, x_transferred
rhn.redhat.com /errata/RHSA-2016-2106.html · vendor-advisory, x_refsource_REDHAT, x_transferred
git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e · x_refsource_CONFIRM, x_transferred
exploit-db.com /exploits/40611/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
access.redhat.com /security/cve/cve-2016-5195 · x_refsource_CONFIRM, x_transferred
source.android.com /security/bulletin/2016-11-01.html · x_refsource_CONFIRM, x_transferred
h20566.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541 · x_refsource_CONFIRM, x_transferred
rhn.redhat.com /errata/RHSA-2016-2124.html · vendor-advisory, x_refsource_REDHAT, x_transferred
fortiguard.com /advisory/FG-IR-16-063 · Third Party Advisory
kb.juniper.net /InfoCenter/index?page=content&id=JSA10770 · Third Party Advisory
kb.juniper.net /InfoCenter/index?page=content&id=JSA10774 · Third Party Advisory
kb.juniper.net /InfoCenter/index?page=content&id=JSA10807 · Third Party Advisory
lists.opensuse.org /opensuse-security-announce/2016-10/msg00034.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00035.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00036.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00038.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00039.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00040.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00045.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00048.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00049.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00050.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00051.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00052.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00053.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00054.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00055.html · Mailing List
lists.opensuse.org /opensuse-security-announce/2016-10/msg00056.html · Mailing List

Sources

CVE List: CVE-2016-5195
NVD: CVE-2016-5195

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary