8

This morning we discover this exploit CVE-2016-5195 How do we patch CentOS kernel? is there any patch available?

http://www.cyberciti.biz/faq/dirtycow-linux-cve-2016-5195-kernel-local-privilege-escalation-vulnerability-fix/

3
  • 2
    Why voting down it is a dangerous vulnerability ?
    – GAD3R
    Oct 21, 2016 at 16:07
  • @GAD3R Oh idk, it seemed VLQ
    – cat
    Oct 21, 2016 at 17:14
  • 1
    The bug is already patched on some of the major versions of Linux , just update your system then verify it by executing the exploit
    – GAD3R
    Oct 21, 2016 at 17:16

4 Answers 4

6

Wait for RedHat (the CentOS upstream vendor) to issue an update, then CentOS will port that update over to the CentOS update repositories so you can simply patch via yum update as normal.

DirtyCOW isn't that scary of a vulnerability. It requires the attacker already has some manner of shell access to your system.

RedHat has got it rated as a CVSSv3 score of 7.8/10, which means it's not something I'd patch outside of the normal monthly patch cycle. It's much more important that you're regularly patching your system at least monthly, as such vulnerabilities are hardly rare.

Update: CentOS has released a fix (Thanks, @Roflo!). Running a yum update should get your system updated with a patched kernel.

4
  • 2
    I beg to differ about it being scary or not. Wordpress and drupal flaws are fantastic to have non-wanted users running non-priviliged commands; I also had an attacker sitting on a phished password for a non-privileged user and using it to log in a bastion host on a week there were 2 escalation vulnerabilities some years ago. Luckly I had already patched Oct 24, 2016 at 21:09
  • 1
    Yes, people must always be mindful of their specific situations. If you're running insecure software, or an application that may allow untrusted users executable access, you'll want to treat this vulnerability as critical. For most situations, though, time spent playing vulnerability whack-a-mole would be better used to harden your server against untrusted access in the first place. Oct 25, 2016 at 14:36
  • 1
    CentOS has uploaded an update. Perhaps you want to update your answer?
    – Roflo
    Oct 26, 2016 at 14:40
  • @Roflo Thanks for the heads up. Answer updated. Oct 26, 2016 at 18:20
1

Can't comment yet...

There is a patch available: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619

Check if CentOS has the patched kernel, if not: decide between taking the risks of compiling Linux yourself or hope that no one gets to execute arbitrary code on your system and actually uses that exploit to do something.

1

You have to wait for a kernel upgrade:

As for 16:17(GMT -3) no packages were released with the fix:

[root@centos7 ~]# yum upgrade
Loaded plugins: fastestmirror
base                                                                                                                                                 | 3.6 kB  00:00:00
extras                                                                                                                                               | 3.4 kB  00:00:00
updates                                                                                                                                              | 3.4 kB  00:00:00
Loading mirror speeds from cached hostfile
 * base: centos.ar.host-engine.com
 * epel: archive.linux.duke.edu
 * extras: centos.ar.host-engine.com
 * updates: centos.ar.host-engine.com
No packages marked for update

[root@centos7 ~]# rpm -q --changelog kernel  | grep -i CVE-2016-5195
[root@centos7 ~]# uname -a
Linux centos7.tbl.com.br 3.10.0-327.36.2.el7.x86_64 #1 SMP Mon Oct 10 23:08:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Same applies to CentOS6.

There is a workaround for this issue using systemtap, but it seems that just works if you are using a kernel with debuginfo enabled.

tl,dr: Wait for a kernel upgrade. Other distros have already applied the patch.

0

a Kernel upgrade to 3.10.0-327.36.3 is now available via yum update, you can see it available here too http://mirror.centos.org/centos-7/7.2.1511/updates/x86_64/Packages/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .