This morning we discover this exploit CVE-2016-5195 How do we patch CentOS kernel? is there any patch available?
-
2Why voting down it is a dangerous vulnerability ?– GAD3RCommented Oct 21, 2016 at 16:07
-
@GAD3R Oh idk, it seemed VLQ– catCommented Oct 21, 2016 at 17:14
-
1The bug is already patched on some of the major versions of Linux , just update your system then verify it by executing the exploit– GAD3RCommented Oct 21, 2016 at 17:16
Add a comment
|
4 Answers
Wait for RedHat (the CentOS upstream vendor) to issue an update, then CentOS will port that update over to the CentOS update repositories so you can simply patch via yum update as normal.
DirtyCOW isn't that scary of a vulnerability. It requires the attacker already has some manner of shell access to your system.
RedHat has got it rated as a CVSSv3 score of 7.8/10, which means it's not something I'd patch outside of the normal monthly patch cycle. It's much more important that you're regularly patching your system at least monthly, as such vulnerabilities are hardly rare.
Update: CentOS has released a fix (Thanks, @Roflo!). Running a yum update should get your system updated with a patched kernel.
-
2I beg to differ about it being scary or not. Wordpress and drupal flaws are fantastic to have non-wanted users running non-priviliged commands; I also had an attacker sitting on a phished password for a non-privileged user and using it to log in a bastion host on a week there were 2 escalation vulnerabilities some years ago. Luckly I had already patched Commented Oct 24, 2016 at 21:09
-
1Yes, people must always be mindful of their specific situations. If you're running insecure software, or an application that may allow untrusted users executable access, you'll want to treat this vulnerability as critical. For most situations, though, time spent playing vulnerability whack-a-mole would be better used to harden your server against untrusted access in the first place. Commented Oct 25, 2016 at 14:36
-
1CentOS has uploaded an update. Perhaps you want to update your answer?– RofloCommented Oct 26, 2016 at 14:40
-
Can't comment yet...
There is a patch available: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
Check if CentOS has the patched kernel, if not: decide between taking the risks of compiling Linux yourself or hope that no one gets to execute arbitrary code on your system and actually uses that exploit to do something.
You have to wait for a kernel upgrade:
As for 16:17(GMT -3) no packages were released with the fix:
[root@centos7 ~]# yum upgrade
Loaded plugins: fastestmirror
base | 3.6 kB 00:00:00
extras | 3.4 kB 00:00:00
updates | 3.4 kB 00:00:00
Loading mirror speeds from cached hostfile
* base: centos.ar.host-engine.com
* epel: archive.linux.duke.edu
* extras: centos.ar.host-engine.com
* updates: centos.ar.host-engine.com
No packages marked for update
[root@centos7 ~]# rpm -q --changelog kernel | grep -i CVE-2016-5195
[root@centos7 ~]# uname -a
Linux centos7.tbl.com.br 3.10.0-327.36.2.el7.x86_64 #1 SMP Mon Oct 10 23:08:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Same applies to CentOS6.
There is a workaround for this issue using systemtap, but it seems that just works if you are using a kernel with debuginfo enabled.
tl,dr: Wait for a kernel upgrade. Other distros have already applied the patch.
a Kernel upgrade to 3.10.0-327.36.3 is now available via yum update, you can see it available here too http://mirror.centos.org/centos-7/7.2.1511/updates/x86_64/Packages/
