This morning we discover this exploit
CVE-2016-5195 How do we patch CentOS kernel? is there any patch available?
Wait for RedHat (the CentOS upstream vendor) to issue an update, then CentOS will port that update over to the CentOS update repositories so you can simply patch via
yum update as normal.
DirtyCOW isn't that scary of a vulnerability. It requires the attacker already has some manner of shell access to your system.
RedHat has got it rated as a CVSSv3 score of 7.8/10, which means it's not something I'd patch outside of the normal monthly patch cycle. It's much more important that you're regularly patching your system at least monthly, as such vulnerabilities are hardly rare.
Update: CentOS has released a fix (Thanks, @Roflo!). Running a
yum update should get your system updated with a patched kernel.
Can't comment yet...
Check if CentOS has the patched kernel, if not: decide between taking the risks of compiling Linux yourself or hope that no one gets to execute arbitrary code on your system and actually uses that exploit to do something.
You have to wait for a kernel upgrade:
As for 16:17(GMT -3) no packages were released with the fix:
[root@centos7 ~]# yum upgrade Loaded plugins: fastestmirror base | 3.6 kB 00:00:00 extras | 3.4 kB 00:00:00 updates | 3.4 kB 00:00:00 Loading mirror speeds from cached hostfile * base: centos.ar.host-engine.com * epel: archive.linux.duke.edu * extras: centos.ar.host-engine.com * updates: centos.ar.host-engine.com No packages marked for update [root@centos7 ~]# rpm -q --changelog kernel | grep -i CVE-2016-5195 [root@centos7 ~]# uname -a Linux centos7.tbl.com.br 3.10.0-327.36.2.el7.x86_64 #1 SMP Mon Oct 10 23:08:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Same applies to CentOS6.
There is a workaround for this issue using
systemtap, but it seems that just works if you are using a kernel with
tl,dr: Wait for a kernel upgrade. Other distros have already applied the patch.
a Kernel upgrade to 3.10.0-327.36.3 is now available via yum update, you can see it available here too http://mirror.centos.org/centos-7/7.2.1511/updates/x86_64/Packages/