I'm writing a report for a university assignment about the Dirty COW vulnerability that was discovered last October (CVE-2016-5195).

I grasp most of how the attack takes place.

However I have found pretty much nothing that explains what is really going on in the kernel, i.e. where the race condition is or more in general what enables the write on the read-only memory mappings.

The only seemingly relevant information I've found is this analysis, but it's just vaguely commented and I can't really extrapolate much information from it.

I would like to be able to at least give an overview of what really happens kernel-wise.

Is there any kernel expert who is able to explain it?

  • 1
    Might help if you gave some more background about yourself—e.g., are you a C programmer? Can you read C code? – derobert Mar 9 '17 at 15:57
  • I'm a Computer Science student. I can read C code and I know the basics, but I can't really say a have a deep knowledge of it. – icydeceit Mar 9 '17 at 16:14
  • Your question is good, although maybe a little bit too broad (a correct answer would need to explain also a lot of things what you need to answer its essence). Sorry I could answer it, but I am now lazy to write this all. I hope somebody won't be. – peterh Sep 29 '17 at 20:42
  • Related (but not dupe). – peterh Sep 29 '17 at 20:43
  • The (excellent) video in the page you link to goes quite far into details. Next level of understanding is brought by the patch itself (here is the RHEL version with interesting additional comments). IMO, your question is too broad, how can we know where you stopped understanding what was going on? You should tell us precisely what part of that video / of the kernel code you don't understand and ask for an explanation. – xhienne Sep 29 '17 at 21:10

Browse other questions tagged or ask your own question.