This morning we discover this exploit CVE-2016-5195 How do we patch CentOS kernel? is there any patch available?

http://www.cyberciti.biz/faq/dirtycow-linux-cve-2016-5195-kernel-local-privilege-escalation-vulnerability-fix/

  • 2
    Why voting down it is a dangerous vulnerability ? – GAD3R Oct 21 '16 at 16:07
  • @GAD3R Oh idk, it seemed VLQ – cat Oct 21 '16 at 17:14
  • 1
    The bug is already patched on some of the major versions of Linux , just update your system then verify it by executing the exploit – GAD3R Oct 21 '16 at 17:16
up vote 6 down vote accepted

Wait for RedHat (the CentOS upstream vendor) to issue an update, then CentOS will port that update over to the CentOS update repositories so you can simply patch via yum update as normal.

DirtyCOW isn't that scary of a vulnerability. It requires the attacker already has some manner of shell access to your system.

RedHat has got it rated as a CVSSv3 score of 7.8/10, which means it's not something I'd patch outside of the normal monthly patch cycle. It's much more important that you're regularly patching your system at least monthly, as such vulnerabilities are hardly rare.

Update: CentOS has released a fix (Thanks, @Roflo!). Running a yum update should get your system updated with a patched kernel.

  • 1
    I beg to differ about it being scary or not. Wordpress and drupal flaws are fantastic to have non-wanted users running non-priviliged commands; I also had an attacker sitting on a phished password for a non-privileged user and using it to log in a bastion host on a week there were 2 escalation vulnerabilities some years ago. Luckly I had already patched – Rui F Ribeiro Oct 24 '16 at 21:09
  • 1
    Yes, people must always be mindful of their specific situations. If you're running insecure software, or an application that may allow untrusted users executable access, you'll want to treat this vulnerability as critical. For most situations, though, time spent playing vulnerability whack-a-mole would be better used to harden your server against untrusted access in the first place. – immortal squish Oct 25 '16 at 14:36
  • 1
    CentOS has uploaded an update. Perhaps you want to update your answer? – Roflo Oct 26 '16 at 14:40
  • @Roflo Thanks for the heads up. Answer updated. – immortal squish Oct 26 '16 at 18:20

Can't comment yet...

There is a patch available: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619

Check if CentOS has the patched kernel, if not: decide between taking the risks of compiling Linux yourself or hope that no one gets to execute arbitrary code on your system and actually uses that exploit to do something.

You have to wait for a kernel upgrade:

As for 16:17(GMT -3) no packages were released with the fix:

[root@centos7 ~]# yum upgrade
Loaded plugins: fastestmirror
base                                                                                                                                                 | 3.6 kB  00:00:00
extras                                                                                                                                               | 3.4 kB  00:00:00
updates                                                                                                                                              | 3.4 kB  00:00:00
Loading mirror speeds from cached hostfile
 * base: centos.ar.host-engine.com
 * epel: archive.linux.duke.edu
 * extras: centos.ar.host-engine.com
 * updates: centos.ar.host-engine.com
No packages marked for update

[root@centos7 ~]# rpm -q --changelog kernel  | grep -i CVE-2016-5195
[root@centos7 ~]# uname -a
Linux centos7.tbl.com.br 3.10.0-327.36.2.el7.x86_64 #1 SMP Mon Oct 10 23:08:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Same applies to CentOS6.

There is a workaround for this issue using systemtap, but it seems that just works if you are using a kernel with debuginfo enabled.

tl,dr: Wait for a kernel upgrade. Other distros have already applied the patch.

a Kernel upgrade to 3.10.0-327.36.3 is now available via yum update, you can see it available here too http://mirror.centos.org/centos-7/7.2.1511/updates/x86_64/Packages/

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.